Capturing traffic flows from 3750 to 6509 then to Netflow

[Zubair.Sayed_2]

Hi fellow networkers,

I am aware that the 3750 switches are not able to support Netflows, so I have created a SPAN port and spanning traffic from a specific port.

I would like to create a seperate VLAN and trunk the traffic from the SPAN port down to the 6509 switch and then capture all the traffic for that VLAN on the 6509.

Will this work or does anybody else have any other suggestions?

Regards

Zubair

[Edison Ortiz]

Yes, that's called RSPAN

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_50_se/configuration/guide/swspan.html

[Zubair.Sayed_2]

Thanks Edison.

I will give this a try and update thread.

Reading through the notes I need to configure my source RSPAN port on the 3750 along with the vlan's etc and then set the destination as the trunk link to the 6509.

I then configure the trunk link to filter that specific vlan and what confuses me is how do I then forward traffic to Netflow, I am assuming I would require a physical interface and not a L3 vlan?

Regards

Z

[Zubair.Sayed_2]

Edison,

I have another question, I went through the document, very helpful indeed but I am stuck at the point where I am creating the RSPAN Destination Session and Step 7 says "For interface-id, specify the destination interface. The destination interface must be a physical interface."

Can I use any available physical interface ?

Thanks

Z

[Edison Ortiz]

The physical interface where the sniffer is connected to on the 6509 side.

The source would be the RSPAN Vlan

On the 3750 side, the source is the packets being captured and the destination is the RSPAN Vlan.

Regards,

Edison