SPAN on switch kills ASA AnyConnect VPN access

[William Becker]

I wanted to see if someone has saw this before. We are setting up a SPAN session on a 3750X stack(2 switches) to monitor the inside interface of a ASA5510. As soon as I set the following on the switch the AnyConnect kills all sessions and you get an error that "AnyConnect is not configured on the server"(or close to that) when you try to reconnect. remove the monitor and reboot returns AnyConnect. This is setup with 2 ASA5510 in failover. Here is how I setup the Switch:

monitor session 1 source interface gig2/0/16 (ASA Inside interface)

monitor session 1 destination interface gig1/0/3 (monitoring device) (I did not specify the encapsulation)

Any ideas or maybe you've saw this before? Any help would be appreciated.

[joe19366]

i suspect one of these ports is an rspan vlan so your perhaps triggering some rule about rspan not learning mac addresses - is that the case?

any other monitor sessions?

code versions?

anyconnect should connect even if the INSIDE port is disabled ;)

so therefore, i think something is happening to your OUTSIDE port.

thanks

[William Becker]

This is the only session for that inside interface, or any other interface for that matter. The monitoring platform is a Palo Alto 5050, this is the first I've used it, we are testing it in our environment. I am very confused why the Anyconnect gets dropped. I am checking to see if there are any issues within the release running on the ASA, I will update if I find anything. All else fails I will open a TAC case, have them look into it and I'll post that as well. 

[joe19366]

a PAN 5050 firewall?

post the topology first link from Internet, first cabling, vlans, etc

we'll figure it out

[William Becker]

OK figured out what was causing the issue. The previous admin setup the switches and mislabeled the switches. Once I checked the through CLI I discovered that I was seting up the monitoring on the wrong ports. 

Lesson learned,  don't trust someone elses work..

Thank you for the replies.