configure 6513 IDSM and Local SPAN failed

[lcd_shouldit]

Hi, my catalyst 6513 IOS version is 12.2(18)SXF16 and  12.2(33)SXI5 , today I want to configure my IDSM module,

I should SPAN my vlan traffic to the IDSM, right?

commands like :

monitor session 4 source vlan 21

monitor session 4 destination intrusion-detection-module 10 data-port 1

But the switch tell me :

% Local Session limit has been exceeded

So, what should I do if I want my IDSM work.

Thank you !

[Thulasi Shankar · Accepted solution]

Hi,

You mayuse VACLs to pass the traffic to the IDSM2. VACL capture allows you to specify whatever vlans you would like to   have the IDSM2 monitor. 

So if you know what vlans  passing on the  etherchannels, then you may include them in the VACL configuration 

For Example :

intrusion-detection module 4 data-port 1 capture allowed-vlan   10-20,40,70

Please find the documentation to configure VACLs on the 6500 switch:

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_idsm2.html#wp1030767

Hope that answers your query.

Thulasi Shankar

[lcd_shouldit]

Hi, Sorry for late.