Cisco ASA 5510 SPAN

[rbrownejr]

Hi,

I'm trying to setup port mirroring on a Cisco ASA 5510, but when I try to use the switchport monitor command, that command is not recognized.

I've selected what interface I want to configure (conf-if), but the switchport command seems to not be part of the IOS.

I'm running ASA version 8.2(1)

Any ideas?

[varrao]

Hi Roy,

What is the command that you are using ???? You need to first create a vlan and assign the physical interface to the vlan with the switchport command, for further details refer this doc:

http://www.cisco.com/en/US/partner/docs/security/asa/asa82/command/reference/i3.html#wp1874313

Let me know if you have any questions.

Hope this helps.

Thanks,

Varun

Please do rate helpful posts.

[varrao]

You can also refer this:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/int5505.pdf

-Varun

[rbrownejr]

Thanks Varun,

Please see the below.  This is the output I get when I try to configure the interface.  The switchport command is not even being recognized.

colo-firewall# conf term

colo-firewall(config)# interface Ethernet 0/3

colo-firewall(config-if)# switchport ?

ERROR: % Unrecognized command

[varrao]

Hi Roy,

What license are you using, I am not sure but switchport command is supported for security plus license only.

Thanks,

Varun

[rbrownejr]

We have the Security Plus license.  The firewall is configured in an Active/Standby setup. 

Don't know if that makes a difference.

Thanks,

Roy

[varrao]

Hi Rob,

Can you provide the output of:

show version

show run interface

show run nameif

show vlan

Thanks,

Varun

[rbrownejr]

Hi Varun,

Please see below.

Thanks

show version:

Cisco Adaptive Security Appliance Software Version 8.2(1)

Device Manager Version 6.2(1)

Compiled on Tue 05-May-09 22:45 by builders

System image file is "disk0:/asa821-k8.bin"

Config file at boot was "startup-config"

colo-firewall up 1 day 4 hours

failover cluster up 125 days 14 hours

Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz

Internal ATA Compact Flash, 256MB

BIOS Flash Firmware Hub @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)

                             Boot microcode   :  CN1000-MC-BOOT-2.00

                             SSL/IKE microcode:  CNLite-MC-SSLm-PLUS-2.03

                             IPSec microcode  :  CNlite-MC-IPSECm-MAIN-2.04

0: Ext: Ethernet0/0         : address is f866.f2fd.18d0, irq 9

1: Ext: Ethernet0/1         : address is f866.f2fd.18d1, irq 9

2: Ext: Ethernet0/2         : address is f866.f2fd.18d2, irq 9

3: Ext: Ethernet0/3         : address is f866.f2fd.18d3, irq 9

4: Ext: Management0/0       : address is f866.f2fd.18d4, irq 11

5: Int: Not used            : irq 11

6: Int: Not used            : irq 5

Licensed features for this platform:

Maximum Physical Interfaces  : Unlimited

Maximum VLANs                : 100     

Inside Hosts                 : Unlimited

Failover                     : Active/Active

VPN-DES                      : Enabled 

VPN-3DES-AES                 : Enabled 

Security Contexts            : 2       

GTP/GPRS                     : Disabled

SSL VPN Peers                : 2       

Total VPN Peers              : 250     

Shared License               : Disabled

AnyConnect for Mobile        : Disabled

AnyConnect for Linksys phone : Disabled

AnyConnect Essentials        : Disabled

Advanced Endpoint Assessment : Disabled

UC Phone Proxy Sessions      : 2       

Total UC Proxy Sessions      : 2       

Botnet Traffic Filter        : Disabled

This platform has an ASA 5510 Security Plus license.

show run nameif:

interface Ethernet0/0

nameif outside

security-level 0

!

interface Ethernet0/1

nameif inside

security-level 99

!

interface Ethernet0/3

nameif testing

security-level 0

!

interface Management0/0

nameif management

security-level 100

show vlan:

I don't currently have any vlans setup. 

show run interface:

!

interface Ethernet0/0

speed 100

duplex full

nameif outside

security-level 0

ip address X.X.X.X 255.255.255.0 standby X.X.X.X

!

interface Ethernet0/1

duplex full

nameif inside

security-level 99

ip address 10.2.1.1 255.255.255.0 standby 10.2.1.2

!

interface Ethernet0/2

description LAN/STATE Failover Interface

!

interface Ethernet0/3

nameif testing

security-level 0

ip address 192.168.2.1 255.255.255.0

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

[varrao]

No it would not work, you need to do this:

int eth0/3

   no ip address

   no nameif

   no security-level

int vlan 2

  nameif testing

  ip address 192.168.2.1 255.255.255.0

  no shut

int eth0/3

   switchport access vlan 2

   no shut

Thats how it works.

Hope this helps.

Thanks,

Varun

[rbrownejr]

Hi Varun,

Thanks for your help.  After doing some more research it appears that this can be setup on the 5505, but not the 5510.

Thanks,

Roy