Cisco – Force VLAN traffic through specified interfaces

bridgeciscofirewalltrunkvlan

I have two VLANs, VLAN1 for "clients" and VLAN2 for (web)servers. Both VLANs have two ports in etherchannel (one Cisco switch). I would like to put transparent (WAF) device in bridge mode between the VLANs in order to monitor/block traffic. What could be the method in order to accomplish this in case of Cisco device (or eliminate this kind of problem).

For example if I use two physical switches, and connect the trunk ports (and bonded) via the transparent device bridge interfaces I can see the traffic.

Im curios about, is it possible to do in one switch between VLANs, if yes what the name or method i should search for?

Thank you!

Best Answer

As Ron Trunk pointed out, bridging VLANs can be problematic in the results. Cisco offers SPAN for network monitoring. You can mirror the traffic from on or more interfaces or VLANs to an interface to which you connect your monitoring equipment. There is also RSPAN that lets you transport the the mirrored traffic across layer-2 to a different switch, and ERSPAN (for select equipment) that will encapsulate the mirrored traffic so that it can cross layer-3.

Understanding SPAN,RSPAN,and ERSPAN

Local SPAN: Mirrors traffic from one or more interface on the switch to one or more interfaces on the same switch.

Remote SPAN (RSPAN): An extension of SPAN called remote SPAN or RSPAN. RSPAN allows you to monitor traffic from source ports distributed over multiple switches, which means that you can centralize your network capture devices. RSPAN works by mirroring the traffic from the source ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN session. This VLAN is then trunked to other switches, allowing the RSPAN session traffic to be transported across multiple switches. On the switch that contains the destination port for the session, traffic from the RSPAN session VLAN is simply mirrored out the destination port.

Encapsulated remote SPAN (ERSPAN): encapsulated Remote SPAN (ERSPAN), as the name says, brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains.

ERSPAN is a Cisco proprietary feature and is available only to Catalyst 6500, 7600, Nexus, and ASR 1000 platforms to date. The ASR 1000 supports ERSPAN source (monitoring) only on Fast Ethernet, Gigabit Ethernet, and port-channel interfaces.

To control traffic between the VLANs, you use something like an ACL on the router that routes traffic between the VLANs.

Related Topic