ASA: replication of an Ethernet port - e.g. for WireShark/archiving

[Joerg.Teske]

Hello

        is there a possibility to perform a replication of a port on a Cisco ASA (e.g. to archive a copy of the data)?

The monitor command to be used on other Cisco equipment is not existing on the ASA.

Best regards

Jörg

[balaji.bandi]

What model of ASA - you can use Packet capture to send over to remote :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html

If the old model with Switch port on it, you can use command - switchport monitor

[Joerg.Teske]

Thank you for this fast answer. I use an ASA-5508-X.

Your link is explaining how to capture packages (mainly local in a buffer of the ASA) and to transfer this data later on.

What I search is to duplicate packages (no change of format, quasi realtime) and to send them to a second destination.
We use this for UDP packages. This is well working using a replicated port on a switch. The aim is to reduce the hardware using directly the ASA. 

The switchport monitor command seems not to be available.

[MHM Cisco World]

https://ultraconfig.com.au/blog/how-to-packet-capture-on-a-cisco-asa-firewall/

Check this' not real time is so hard to asa cpu.

Keep capture real-time as short ss possible.

MHM

[Joerg.Teske]

Thank you. See above. This is not what we need. Sorry if I was not clear enough.

[MHM Cisco World]

copy /pcap capture:pc-traffic-ssh tftp://<server-ip-address>

This copy pcap to server which then can show via wiresharke.

But I think you want real time monitoring.

I will check 

MHM

[Joerg.Teske]

Thank you, I'm not sure that the ASA is able to perform this replication - I found only the following for other Cisco elements:

https://www.it-connect.fr/configurer-le-port-mirroring-sous-cisco/