IPS 4240 on IDS - SPAN issue

J_Vansen_S — Sun, 10 Mar 2019 11:48:08 GMT

Device: IPS 4240

MOde: all 4 interfaces on Promiscuous

Objective: To monitor 4 different vlans namely vlan 10,20,30,40 across the network.

There are 8 switches on my network with vlan 10 - 40 info (vtp trunk)

How do i configure SPAN on VLANs that exist on all my access switches

I tried configuring on the access switch where the IPS interfaces are connected to.

monitor session 1 source vlan 10 , 20 , 30, 40

monitor session 1 destination interface Gi0/1 - 4

Did a mass ping from vlan 10 to its gateway

Checked my IPS interfaces status, i seem to be receiving packets on all 4 interfaces. Shouldnt i be receiving packets on the correct IPS interfaces that the vlan is destined?

Please advise

Re: IPS 4240 on IDS - SPAN issue

dhananjoy chowdhury — Sun, 18 Oct 2009 05:22:14 GMT

monitor session 1 source vlan 10 , 20 , 30, 40

monitor session 1 destination interface Gi0/1

The above commands will span the traffic (tx/rx) traffic in ALL the vlans 10,20,30,40 , but this will be limited to traffic only the switch on which this is configured.

For getting traffic in the same vlans but on other switches, you will have to configure RSPAN.

Refer to this link for more details.

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

topic Re: IPS 4240 on IDS - SPAN issue in Network Security

IPS 4240 on IDS - SPAN issue

Re: IPS 4240 on IDS - SPAN issue