nx.os.and.cisco.nexus.switching.2nd.edition.1587143046

Jealousy(config-if)# switchport monitor
Jealousy(config-if)# end
Jealousy#
If the device is an IDS/IPS, it might be required to have it participate in the network where
the switch must learn the MAC address of the device and where the IDS/IPS might need to
inject traffic, as shown in Example 7-2. Typically, IPS actively participate in the network to
inject traffic to thwart an attack. In these cases, the ingress and the learning configuration
parameters will be wanted.
Example 7-2. Configuring a SPAN Monitor Port for IDS/IPS
Click here to view code image
Jealousy# config t
Enter configuration commands, one per line. End with
CNTL/Z.
Jealousy(config)# int e1/26
Jealousy(config-if)# switchport
Jealousy(config-if)# switchport monitor ingress learning
Jealousy(config-if)# end
Jealousy#
After the monitor port is configured, the next step is to configure the SPAN monitor session.
Source and destination interfaces are configured under the SPAN monitor session in
addition to VLAN filters. Finally, the state of the SPAN session, shut or no shut, is
configured in SPAN monitor session mode as well. In Example 7-3, a monitor session is
configured that will SPAN traffic from VLANs 100, 101, and 102 to destination port e1/26.
This SPAN monitors traffic that ingresses (rx) VLAN 100, traffic that egresses (tx) VLAN
101, and both on VLAN 102.
Note
The default direction for SPAN monitoring is both. Use of tx or rx direction narrows
the traffic monitored.
Example 7-3. Configuring a SPAN Monitor Session
Click here to view code image
Jealousy# config t
Enter configuration commands, one per line. End with
CNTL/Z.