Span Port Session in Catalyst 6500 & 4500 series

Hi,
May I know the maximum monitor session for latest Catalyst 6500 & 4500 series?
Thanks

Hi,
See the below links wich provide all details about the SPAN sessions:
6500
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/span.html#wp1036881
4500
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sg/configuration/guide/span.html#wp1020415
Regards,

Similar Messages

Advantages of 10/100 Management port on 6500/4500 series

Hi mates,
There is a common port called "10/100 MGT" (next to console port) on the supervisor engines of 6500 and 4500 series switch.
Why would I need that port since I can telnet through Layer2 10/100 ports??
Is that port doing the same job as console port? in addition allows longer distances over cat 5 cables??
Do we need to assign IP address on that mangement port?
Thanks for helping :)

Hi,
The 6500 supervisors do not have a 10/100 MGT port. The cat4000 supervisors do, however.
On the supI and supII, the Ethernet management ports are for network management only. These ports do not support network switching. See:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/inst_gd/05modins.htm#xtocid184774
On the SupII+, SupIII, and higher, the Ethernet management port is used (in ROMMON mode only) to recover a switch software image that has been corrupted or destroyed due to a network catastrophe. This port is not active while the switch is operating normally.
See:
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/hw_doc/78_13686.htm#wp32993
HTH,
Bobby
*please rate helpful posts

Span port channel

Hi All,
Is there any option to span port channel of Cisco 6500 Switch.If possible What is the configuration for the same..
Pls help..
Regards,
Ajith

Hi,
You can, but the Portchannel has to be in on mode. You cannot use it wilt LACP or PAGP.
Note:
From Cisco IOS Software Release 12.2(33)SXH and later, PortChannel interface can be a destination port. Destination EtherChannels do not support the Port Aggregation Control Protocol (PAgP) or Link Aggregation Control Protocol (LACP) EtherChannel protocols; only the on mode is supported, with all EtherChannel protocol support disabled.
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml
HTH
Reza

How many span ports are supported on Sup2T and Catalyst 6880?

Hi,
I did not find any information concerning this.
Would be great if anybody could send me a link to the information how many span ports are supported on the new Cat68 series.
Regards
Thorsten Steffen

For sup2t
========
Local SPAN, RSPAN, and ERSPAN Session Limits
Total Sessions
Local and Source Sessions
Destination Sessions
Local SPAN,
RSPAN Source,
ERSPAN Source
Ingress or Egress or Both
Local SPAN Egress-Only
RSPAN
ERSPAN
80
2
14
64
23
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/config_guide/sup2T/15_1_sy_swcg_2T/span_rspan_erspan.html
Regards,
Naveen
****Rate if it is helpful****

How to remove the WiSM2 from the Catalyst 6500 series switch?

Hello, can you explain to me how to safely remove the WiSM2 from the Catalyst 6500 series switch?
According to the documentation "Catalyst 6500 Series Wireless Services Module 2 Installation and Verification Note":
To remove the WiSM2, perform these steps:
Step1     Shut down the module by one of these methods:
In privileged mode from the router prompt, enter the hw-mod module mod shutdown command. NoteIf you enter this command to shut down the module, you must enter the following commands in global configuration mode to restart (power down, and then power up) the module:
Router# no power enable module modRouter# power enable module mod
If the module does not respond to any commands, press the SHUTDOWN button located on the front panel of the module.
Step2     Verify that the WiSM2 shuts down. Do not remove the module from the switch until the POWER LEDis off.
But, in the case of Step1 (1st methods) I do not see a option "shutdown" in the command "hw-mod module 3"...
All I prompted to enter is:
c6500#hw-module module 3 ?
boot           Specify boot options for the module through Power Management Bus control register
reset          Reset specified component
simulate Simulate options for the module
Is it hidden options? IOS version of c6500 is 12.2(33)SXJ1
In the case of Step2 (2nd methods) there is not any button on the front panel of the module?
And yet, it is better to remove the module configuration manually or use the command module clear-config prior to removing the module?

Good catch.
Which one is true, will get back to you on this if i've something soon.
http://www.cisco.com/en/US/docs/wireless/module/wism2/installation/note/WiSM_2.html#wp34727
The above link is procedure to remove wism2. This procedure doesn’t look like wism2 is hot swapable.
http://www.cisco.com/en/US/docs/wireless/module/wism2/installation/note/WiSM_2.html#wp34621
All modules, including the supervisor engine (if you have redundant supervisor engines), support hot swapping. You can add, replace, or remove modules without interrupting the system power or causing other software or interfaces to shut down. For more information about hot-swapping modules, see the Catalyst 6500 Series Switch Module Installation Guide.

NEXUS span session getting twice the data to the span port

I'm setting up a montitor session on a NEXUS 7K as below.
we are receiving in 150M of data and 0 data going out port 9/25.
but port 4/24 shows 300M to the span port?
Am I doing something wrong here or is that normal?
monitor session 10
     no shutdown
     source int e 9/25 both
     destination int e 4/24

i just confirmed that when I span port on NEXUS 7K ios version 6.1(1) the RX data is duplicated to teh span port.
does anyone know of bugs related to that ?

After upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T to the latest release the ASA-SM module is not recognized

after upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T to the latest release the ASA-SM module is not recognized it is disabled. the FPD
is not recognized any more. reverted back to previous ios with no luck

Duplicate post.
Being discussed actively in this thread.

After upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T ASA-SM is disabled

after upgrading ios Cisco Catalyst 6500 Series Supervisor Engine 2T to the latest release the ASA-SM module is not recognized it is disabled. the FPD
is not recognized any more. reverted back to previous ios with no luck

What IOS are you running on your Supervisor 2T? As long as it's 15.0(1)SY1 or later you should be OK. (Reference).
If it's not working with that I'd try reload of the ASA SM module (from IOS cli - e.g. "hw-module <module#> reset" and, failing that, "no power-enable module <module#>" followed by "power-enable module <module#>) while the new Supervisor is installed. Watch the log for relevant messages during that process.

Span port 6500 12.1-(20)E MSFC2 inpkts

From my research, it looks as if the CatOS had an inpkts keyword with spanning ports that allowed the SPAN port to receive normal incoming traffic. Is there an option like that in the IOS/MSFC2 configuration? Thanks.

That feature is not supported in Native IOS code for Cat6000:
Features Not Supported
Ability to accept ingress traffic on SPAN destination ports (CatOS equivalent - set span ... inpkts enable)
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/12_1e/ol_2310.htm

CS11800 - Can I have a SPAN port for my IDS box?

I have a network design that calls for a few CS11800s and it's smaller brother. The security team has asked if this content switch has a SPAN port that is availble so we can hang our IDS box off.
Thanks
B

I am not extremely familiar with the CS11xxx series and its configuration options, but I can tell you that from experience with Cisco Catalyst switches and non-Cisco IDS devices a SPAN port is not always the best solution. In some instances I have had to disable packet learning in the SPAN session, and in other cases I have had to forego using SPAN at all and settled for an uplink to a hub that connected the IDS device and my router(s). This is especially true if the IDS device needs to be a member of the same VLAN as the traffic it is monitoring in order to send RST packets back onto the segment.
I have researched this issue on my own and even opened TAC cases for a solution, but have received solutions ranging from "There's no reason this shouldn't work" to "You can not set up a SPAN session for IDS purposes." My recommendation would be (even though it does decrease performance a bit) to implement the hub solution, regardless of the CS11800 capabilities. This will prove to remove any potential X factors in the SPAN functionality and make your life a lot easier.
Just my 2 cents. :)

SPAN port or Capture?

We currently have Cat6513 switches installed and our looking into an IDSM-2 module, but for the time being until we can actually purchase them, I would like to install a few snort sensor into the switch to "monitor" a few VLANs.
I've read where there are only two SPAN ports and to gain some type of correlation to the events, I figure I would need to install a separate snort sensor for each vlan. The problem is the limit of two SPAN ports. I heard that there is a way to utilize a "capture" feature on the 65xx systems.
Is the appropriate way for this to use the "capture" commands and if so how would I do that?
Also, I read where the SPAN ports have no performance impact on the switch, but would the "capture" commands?
I apologize if this is the wrong forum for this but I wasn't sure if this would be more of a switching or IDS question...
Thanks for any assistance!
-Jeff

The solution to that issue of only two span ports is to use VACLS. There is documentation in the Configuring the Cisco Intrusion Prevention System Sensor Using the Command Line Interface 5.1.
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html#wp1030828
Refer to Catalyst 6500 Series Switch Command Reference for more information on trunk ports and ACLs.

SPAN port question

Hi,
I have two core switches 6500 and Access switches 4500. Both chassis. I need to span ports, but this ports are not in a vlan. I know that there is a limit to span ports that are not in a vlan. Does anyone know which is the limit? Is there a way to make all of them to span?
Thanks!

Hi Pablo
As a forum focused on technical documentation, we checked to see if there was a doc that might answer your question.
There is not enough information in your question to for us to pinpoint exactly what you need, but have you looked at, for example, “Configuring SPAN, RSPAN, and ERSPAN” for the Catalyst 6500 (IOS 12.2SX)”?
If this doesn’t help, we’ll refer your question to the appropriate tech support community. They will probably find it helpful to know what operating system (CatOS or IOS) and which release you have, since this determines what SPAN features and restrictions are in effect.
Thanks for posting,
Hilde

Nexus 9k span port

Can someone provide instructions of how to configure a span port/monitor session on a 9k?

Hi Joris,
SPAN source functionality on satellite ports and host interface port channels is not supported when the FEX is connected to F2 Series modules. Beginning with Cisco NX-OS Release 6.2(2), FEX ports are supported as an egress SPAN source on F2e Series modules.
http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/system_management/configuration/guide/sm_14span.html#wp1239670
Nexus7k# show module
Mod Ports Module-Type                         Model              Status
1    0      Supervisor module                 N7K-SUP2           active *
3    48     1/10 Gbps Ethernet Module           N7K-F248XP-25      ok
Mod Sw              Hw
1    6.x(x)          1.0
3    6.x(x)          1.1
Mod MAC-Address(es)                         Serial-Num
1    84-xx-xxx to 84-xx-xxxx JAxxxxxxxx
3    00-xxx to 00-xxxxx JAxxxxxxx
Mod Online Diag Status
1    Pass
3    Pass
* this terminal session
Regards
Jens

Spanned port for IDS

We're about to get an IDS system which will require a spanned port on the inside of our network. Inside our network we have a few 6500's so I'd span a port on one of our core switches...my question is, there is definetly more then 1GB of traffic going through the core at any time...how would I get all this traffic to the IDS system? Would I just create an etherchannel and use it as a destination, and plug all the ports into the IDS?

Thanks for that link. According to that link you have to have seperate IDS's attached to the etherchannel (one per port):
"The IPS appliances must be in on-a-stick mode, meaning that the IPS appliance can only use one sensing port on that Catalyst switch. That port is trunked so that the IPS appliance has an inbound and outbound path to and from the switch."
Am I reading that wrong? Can I have one IPS with three or four ports attached to the same switch in an etherchannel?
It's starting to sound like I'm going to have to limit what ports I source...which means the IDS could potentially miss a threat or report it later then it could....

Vss quad sup support for 4500 series

Hi all
I'm looking at at 4507r+e with dual supervisor 7
I want to run vss, however does it support quad supervisors?
I hear the second one will have to be in rommon?
In a failover how would I get the 2nd supervisor working ?
Would you need to manually boot it?

Have a look at the config guide:
Quad-Supervisor (In-chassis Standby Supervisor Engine) Support
The Catalyst 4500 series switches support dual supervisors in a redundant chassis, which can be configured for SSO or RPR mode. However, when a chassis is running in VSS mode, it supports a second supervisor engine, but only in rommon mode. In-Chassis-Standby (ICS) can not participate in control, management, or forwarding plane functioning. This makes ports on the supervisor engine in rommon mode available for forwarding although it neither participates in any switchover nor provides protection against any failure. In VSS mode, an In-Chassis-Active (ICA) supervisor engine participates in VSS control/ management operation and manages ports on the supervisor engine in rommon mode.
If the second supervisor engine is inserted in a redundant chassis, the following information applies:
•It must also be manually configured for VSS mode, i.e., it must have been converted from standalone to VSS mode previously. If you insert a supervisor engine that was not configured for VSS mode, it will disrupt the operation of the ICA supervisor engine. If it was previously configured, automatic boot must be disabled (i.e., to boot only to ROM Monitor) with the confreg command in rommon.
The supervisor engine does not takeover or boot automatically when the ICA supervisor engine fails. A manual boot up is required to make it participate in VSS; it then functions as an ICA supervisor engine.
More details on rommon commands are found at this URL:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/rommon.html#wp1013959
•A supervisor engine's conversion from standalone to VSS occurs per engine. If two supervisor engines exist in a chassis, one should be retained in rommon or removed, before conversion occurs. You can convert the second supervisor to VSS mode while the first supervisor is removed or in rommon, with the additional step of setting it to "boot only to ROM Monitor." When both engines are converted to VSS, they can be inserted into the chassis together and re-booted.
•Booting a chassis with two supervisor engines configured for VSS causes one of the engines to become the ICA and participate in VSS. The other engine, which becomes the ICS, will continuously reload. The secondary supervisor (the ICS) must be configured to "boot only to ROM Monitor" with automatic boot disabled.
•When the ICA fails, the ICS doesn't take over because ICS support of SSO or RPR mode is unavailable. ICS (the secondary supervisor) must be booted manually to become the ICA and manage the VSS operations. For this to happen, the former active supervisor engine must remain in rommon mode.
•ISSU support requires ICA supervisor engines on both chassis. The ICS supervisor engine does not participate in upgrade or any forwarding operations.
•Because ICS supervisor engines do not communicate with ICA supervisors, VSS and other configurations must be done at conversion time on the ICS. If not done or the configurations do not match the necessary VSS parameters (like, SwitchId, Domain, and VSL configurations), it cannot form a VSS when ICA goes down and ICS is booted manually. You can, however, enter these "bootup" commands to make it join an existing VSS domain.
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/vss.html#wp1204229
HTH

Span Port Session in Catalyst 6500 & 4500 series

Similar Messages

Maybe you are looking for