Cisco – IP ACL for SPAN port on 3560

ciscopacket-sniffer

My scenario is that I have > 1g of traffic on a switch, but only a 1g monitor port. But the traffic I'm actually interested in is only about 10mbps, the rest can be ignored.

I have one 3560 switch, and I want to configure a SPAN port but also enable an IP ACL. I understand this is possible, at least on the 6500s, by configuring one session with a destination of an RSPAN VLAN, and another session (same switch) using that RSPAN VLAN as the source. Then apply an ACL to the RSPAN VLAN. This is described here: Using RSPAN with VACLs for Granular Traffic Analysis .

However, this doesn't seem to work on a 3560. I even removed the ACLs, and still no-go:

vlan 555
 remote-span
interface Vlan555
 no ip address
 shutdown
monitor session 50 source interface Fa0/24
monitor session 50 destination remote vlan 555
monitor session 51 destination interface Fa0/22
monitor session 51 source remote vlan 555

No traffic shows up. If I clear those monitor sessions and just do source fa0/24 dest fa0/22, then it works fine. (Ignore that I'm using FE here as a test.)

Any ideas? Other ways of getting an ACL into a SPAN without needing a second switch?

Update: Well according to this:

Can a RSPAN Source Session and the
Destination Session Exist on the Same
Catalyst Switch? No. RSPAN does not
work when the RSPAN source session and
the RSPAN destination session are on
the same switch.

That's a limitation on 4500 and 3750, so I guess that means 3560 too. Any other workarounds?

Update 2: I'm not quite sure what RSPAN actually does on the wire. I configured RSPAN, but instead of putting it on a trunk port to another switch, I put it onto a trunk port to my NIC. Traffic is replicated, but the RSPAN VLAN's ACL is not applied, even though the 3560 config document explicitly says it should work.

Best Answer

If I understand right, it sounds like you want to capture some traffic traversing your switch, but you want to filter that traffic before it is placed on the wire connecting to the capturing station.

I doubt you can do that with a 3560-class switch. Check this config guide. I didn't see in there any mention of VACL's within RSPAN sessions. Not that the feature couldn't possibly exist, but from what I remember, VACL's are 6500-specific and are used mainly to filter live traffic passed within any particular VLAN.

I would look at other ways of isolating the interesting traffic, unless you can RSPAN the traffic to a 6500.

Related Topic