RSPAN with ACL in 3560G Switches

[hxmengmetro]

Hi All,

I'm trying to setup RSPAN across multiple switches. The traffic I'm interested is only about 5Mbps. I want to filter it before switch put it into the RSPAN. Is there anyway to do that? I heard 6500 can do this by creating a dummy vlan interface. Can 3560G switches do the same?

Thanks.

Lou

[Antonio Knox]

You can filter ip addresses at the sniffer, but at the switch, you can do vlan filtering.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.1_19_ea1/configuration/guide/swspan.html#wp1210225

Hope that helps.

Message was edited by: Antonio Knox

[hxmengmetro]

Thanks for the reply. I know I can setup filter in sniffer. The vlan filtering in switch is not what I want because the interested traffic and uninrested traffic remains in the same vlan.

Lou

[Antonio Knox · Accepted solution]

Yes, this will be supported in version 12.2(44)SE, but it isn't very well documented yet since it's fairly new.  Here's a link for info on flow-based SPAN:

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6969/ps5012/prod_bulletin0900aecd807382e4.html

[hxmengmetro]

Thanks Antonio. It seems only E series switch support this new feature. Our switches are not E series. Sad.

Thanks for your help!

Lou

[Antonio Knox]

Look a bit closer.

Cisco Catalyst® 3750-E, 3750, 3560-E, 3560, 2960, and 2970 Series Switches

Update: No Joy.  I checked the tables. Bummer......

[hxmengmetro]

Unfortunately, when you look down at the table. The column for 3560-IPB has Flow-based SPAN "No". Sad.