mirror physical port to vmware VM

[xSauronx]

i need some help mirroring a port through a couple of switches to a vmware virtual machine, if possible. some light reading suggests RSPAN is the way to do this, but i do not do enough networking to be comfortable without asking for some help first.

we have a security vendor that uses linux to run their IDS software
In some offices we have a physical linux PC with 2 NICs configured to handle this. I connect it to the core switch, and create a mirror session from the router/switch uplink port to a port connecting the 2nd nic in the pc [both ports on the same switch].

in one site, however, we have 1 vmware server with some VMs. it has 4 NICs, but only 3 are in use right now. it makes sense to me to try and use a linux vm for this, if possible.

the topology is: router > core switch 3750; core switch 3750 > server rack switch 3560g ; server rack switch 3560g > vmware server

we'd like to mirror the traffic from the connection {router > core switch 2750} across the 3560 to a VM. can this be done? or should we just get another physical pc for this site and do it the way we have everywhere else?

 

[kevnich2]

I'm not sure if what you're wanting is actually even possible across different switches and into a vmware server but it definitely seems like the way to go would be using a physical PC directly attached to the switch that your wanting the port mirror.

vmware can use vlan's properly but I've never seen any options to do what you're asking. I can definitely see why you'd want to do what you're asking but with what I've seen, I don't see it as a possibility, atleast right now.

 

[drebo]

Into a VMWare server shouldn't be an issue. Just set the port group to be Promiscuous and it'll forward all traffic to the guest VM.

As far as RSPAN, I've never set it up myself, but following this document should get you going: http://www.cisco.com/c/en/us/td/doc...9_ea1/configuration/guide/2950scg/swspan.html

 

[xSauronx]

I'm not sure if what you're wanting is actually even possible across different switches and into a vmware server but it definitely seems like the way to go would be using a physical PC directly attached to the switch that your wanting the port mirror.

vmware can use vlan's properly but I've never seen any options to do what you're asking. I can definitely see why you'd want to do what you're asking but with what I've seen, I don't see it as a possibility, atleast right now.

well, i knew it was probably an odd request. a pc would be more straightforward, for sure.

Into a VMWare server shouldn't be an issue. Just set the port group to be Promiscuous and it'll forward all traffic to the guest VM.

As far as RSPAN, I've never set it up myself, but following this document should get you going: http://www.cisco.com/c/en/us/td/doc...9_ea1/configuration/guide/2950scg/swspan.html

i will look into both of these ideas and see if i can make something work...or if i just take and old pc and set it up instead

thanks

 

[RadiclDreamer]

You should be able to RSPAN to the switch that connects to the VMWare physical server and then map that to the vm

 

[kevnich2]

well, i knew it was probably an odd request. a pc would be more straightforward, for sure.



i will look into both of these ideas and see if i can make something work...or if i just take and old pc and set it up instead

thanks

Let us know how that turns out for you - interested in hearing the results!