SPAN question on Cisco 871

[boeckelr]

Hi guys,

I posted a message earlier this month after I screwed up my Cisco 871, and I received a lot of helpful replies.

I have one more quick question that should be easy to answer.

Right now I have my DSL modem connected to my 871's WAN port (Fa4). I would like to set up a SPAN session to monitor what is going on outside of my router.

However, when I type in the following "monitor session 1 source interface FastEthernet4", the cli refuses to accept it.

Since I am using a DSL modem, and receiving a dynamic IP address (the interface is set to ip negotiated and another interface was created in my config - "Dialer0", and I also tried to use that instead of "FastEthernet4"....but the cli refuses to accept it also.

I tried a bunch of other things too....I tried creating the destination interface first...but it makes no difference. I am able to successfully able to create a SPAN session with Fa0, Fa1, Fa2 and Fa3 as sources....just not Fa4.

Somehow I remember having this exact same problem a few years ago....and if I remember correctly, I think I was able to solve it...but I cant remember how. I initially thought it had to do with my syntax when I enter the "monitor session 1....." command, but I have tried everything that I can think of with no luck.

It doesnt make sense to not be able to use the WAN port as the source for SPAN....I can do it with my ASA5505....why not with my 871?

So am I doing something wrong? I am currently using IOS 12.4-11T. but earlier I tried 12.4-24T5 and had the same results.

Thanks in advance for your help.

Mike

 

[Cooky]

Per Matt Blanshard from Cisco, you can't span from a routed port...at least not on the 800 series routers.
It seems on the 6K's such limitation doesn't apply.

 

[m1ldslide1]

Per Matt Blanshard from Cisco, you can't span from a routed port...at least not on the 800 series routers.
It seems on the 6K's such limitation doesn't apply.

Doesn't surprise me on the 800's. Other router platforms support it.

You could always export flow data using netflow... Not quite the same, but you'll get a lot of info.

 

[spidey07]

Per Matt Blanshard from Cisco, you can't span from a routed port...at least not on the 800 series routers.
It seems on the 6K's such limitation doesn't apply.

It's a hardware/asic/platform thing.

Spanning requires much more than one would think from a control plane/switching plane perspective. They still can't get around the two span session limitation on 6500s and from what I can remember, 7600s.

 

[Railgun]

Nexus 7ks can't either surprisingly.

 

[m1ldslide1]

Nexus 7ks can't either surprisingly.

To which module are you referring? Nexus 7k's F1 module supports 16 SPAN sessions.

 

[RadiclDreamer]

I thought it was odd that the nexus 2148 cant span to the same nexus, so for example you cant span port 1 in the chassis to port 2 in the same chassis, it has to be on another chassis

 

[Railgun]

To which module are you referring? Nexus 7k's F1 module supports 16 SPAN sessions.

That`s only one module and I don`t think many are going to use that as a typical access layer solution. I was referring specifically to the M148GT modules.

Although it`s only L2 and that`s what it`s pretty much designed for, I think most want more density. Load those up in a 7010 and you lose 128 ports. For a high density solution, that`s a lot.

 

[spidey07]

Well the 7k isn't really meant to be an access layer solution. It's more of a 10 gig aggregator/core.

 

[sactwnguy]

On a 6500 VACL's are a good alternative to the 2 span limit.

 

[m1ldslide1]

Well the 7k isn't really meant to be an access layer solution. It's more of a 10 gig aggregator/core.

Exactly - you get your 10G density out of the 2k's and etc. I'm not sure I even understand what he means by Layer 2 only and losing density with the M1 cards and etc?