SPAN Configuration in 3750

[Karthikeyan Shanmugam]

I have configured SPAN in cisco 3750 switch as below mentioned. but the destination port protocol is down. Please help on this.

switch(config)#monitor session 1 source interface gigabitethernet1/0/1
switch(config)#monitor session 1 destination interface gigabitethernet1/0/11 ingress vlan 1
Thanks,
Karthik

[siddhartham]

Looks like a typo, did you use the same port for source and destination (G1/0/1)?

[smehrnia · Accepted solution]

Hi Karth,

There are a few points you have to take into consideration when configuring SPAN (2 are important here for u):

1. The destination port CANNOT be a source port; a source port CANNOT be a destination port.

2. You can configure a disabled port to be a source or destination port, but the SPAN function does not start until the destination port and at least one source port is enabled.

plz Rate if it helped.

Soroush.

[Karthikeyan Shanmugam]

Hi Sorou,

Thanks for your response.

By mistake i have mentioned the destination port. Now i have changed the destination port as below i mentioned. but still i am facing the same issue.

switch(config)#monitor session 1 source interface gigabitethernet1/0/1
switch(config)#monitor session 1 destination interface gigabitethernet1/0/11 
ingress vlan 1
Thanks,
Karthik

[smehrnia]

Hi Karth,

lets reset your interface to default and see if it works.

(config_int)# default interface gi1/0/11

remove ther keywork ingress vlan 1 (keep it simple first), if didnt work, try another interface as destination, see if it works.

more reference:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_52_se/configuration/guide/swspan.html

plz Rate if it helped.

Soroush.

[Karthikeyan Shanmugam]

Hi Soroush,

I have tried all the steps, still the protocol is down.

Switch#show int gi1/0/11

GigabitEthernet1/0/11 is up, line protocol is down (monitoring)

  Hardware is Gigabit Ethernet, address is 0021.1c1d.bf8b (bia 0021.1c1d.bf8b)

    MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,

     reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation ARPA, loopback not set

  Keepalive set (10 sec)

  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX

  input flow-control is off, output flow-control is unsupported

  ARP type: ARPA, ARP Timeout 04:00:00

  Last input never, output 00:01:44, output hang never

  Last clearing of "show interface" counters never

  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 318

  Queueing strategy: fifo

  Output queue: 0/40 (size/max)

  5 minute input rate 104000 bits/sec, 53 packets/sec

  5 minute output rate 323000 bits/sec, 181 packets/sec

     163100617 packets input, 43712252806 bytes, 0 no buffer

     Received 3147082 broadcasts (144566 multicasts)

     2474 runts, 0 giants, 0 throttles

     2474 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

     0 watchdog, 144566 multicast, 0 pause input

     0 input packets with dribble condition detected

     494091876 packets output, 142313926957 bytes, 0 underruns

     0 output errors, 0 collisions, 0 interface resets

     0 babbles, 0 late collision, 0 deferred

     0 lost carrier, 0 no carrier, 0 PAUSE output

     0 output buffer failures, 0 output buffers swapped out

Switch#

Thanks,

Karthik

[glen.grant]

     That is the normal output when configured as a span port , it is fine.   As long as it says monitoring it is fine. Also the 5 minute input and output shows it passing traffic.  From a cisco span doc.

SPAN Destination Port Up/Down

When ports are spanned for monitoring, the port state shows as UP/DOWN.

When you configure a SPAN session to monitor the port, the  destination interface shows the state down (monitoring), by design. The  interface shows the port in this state in order to make it evident that  the port is currently not usable as a production port. The port as  up/down monitoring is normal.

[Karthikeyan Shanmugam]

Hi,

I have connected the websense network agent server in destination port. I want to monitor/control all the traffic which are coming from the source port, for that the destination port(monitored) should be up and forward state. Please suggest on this.

Thanks,

Karthik

[siddhartham]

It will still be Down(monitoring), below is the status of our port where the websense is connected

GigabitEthernet0/2 is up, line protocol is down (monitoring)