cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
551
Views
0
Helpful
1
Replies

SPAN configuration between cisco 4500 in VSS and firewall fortinet 1200

crisol
Level 1
Level 1

We need to SPAN port channel 16 (members te1/1/7 and te2/1/7) as source and destination to same switch at interface te1/1/9.

Current configuration below:

interface Port-channel16
switchport
switchport access vlan 120
switchport mode access

!

interface TenGigabitEthernet1/1/7
switchport access vlan 120
switchport mode access
channel-group 16 mode desirable

...

!

interface TenGigabitEthernet2/1/7
switchport access vlan 120
switchport mode access
channel-group 16 mode desirable

!

interface TenGigabitEthernet1/1/9
!

interface TenGigabitEthernet2/1/9
!

monitor session 2 source interface Po16
monitor session 2 destination interface Te2/1/9
monitor session 10 source interface Po16
monitor session 10 destination interface Te1/1/9


RDW_CORE_VSS#sh etherchannel sum
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use N - not in use, no aggregation
f - failed to allocate aggregator

M - not in use, minimum links not met
m - not in use, port not aggregated due to minimum links not met
u - unsuitable for bundling
w - waiting to be aggregated
d - default port

A - formed by Auto LAG


Number of channel-groups in use: 12
Number of aggregators: 12

Group Port-channel Protocol Ports
------+-------------+-----------+----------------------------------------
1 Po1(SU) - Te1/1/15(P) Te1/1/16(P)
2 Po2(SU) - Te2/1/15(P) Te2/1/16(P)
10 Po10(SU) - Te1/1/1(P) Te2/1/1(P)
11 Po11(SD) -
12 Po12(SU) - Te1/1/3(P) Te2/1/3(P)
13 Po13(SU) - Te1/1/4(P) Te2/1/4(P)
14 Po14(SD) PAgP Te1/1/5(D) Te2/1/5(D)
15 Po15(SD) PAgP Te1/1/6(D) Te2/1/6(D)
16 Po16(SD) PAgP Te1/1/7(I) Te2/1/7(I)
17 Po17(SU) PAgP Te1/1/8(P) Te2/1/8(P)
30 Po30(SU) - Te1/1/2(P) Te2/1/2(D)
128 Po128(SU) LACP Te1/1/13(P) Te2/1/13(P)

 

Questions:

1. Do we need to specidy a vlan at the destination interface te1/1/9 or te2/1/9? Currently those interfaces are blank.

2. No traffic is seen in the destination side by the capturing device. What is missing in our configuration?

 

Thanks

Crisol

1 Reply 1

Francesco Molino
VIP Alumni
VIP Alumni
Hi

No need to add a vlan for your span receiver.
You should configure both interface member as source because there're in individual more that means not bundled into port-channel.
You certainly have an issue on the other end of the port-channel that's why there're not bundled

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Review Cisco Networking for a $25 gift card