Documentation Center
AlienVault® USM Anywhere™

Configuring the Cisco SGxxx Series for Port Mirroring

Cisco switches support a feature known as SPAN (short for Switch Port Analyzer) which allows traffic received on an interface or VLAN to be sent to a single physical port. SPAN technically implies that the source and destination ports are local to the same switch. If the traffic destination is on another remote switch, it uses Remote SPAN (RSPAN). If the destination requires crossing one or more IP networks, some switches can use Encapsulated Remote SPAN (ERSPAN).

Important: USM Anywhere supports both SPAN and RSPAN. It does not support ERSPAN.

To configure port and VLAN mirroring

  1. On the device, select Administration > Diagnostics > Port and VLAN Mirroring.
  2. If your switch supports RSPAN

    • RSPAN VLAN — Select Enable to enable RSLAN VLAN mirroring.
    • RSPAN VLAN ID — Select the VLAN to be mirrored.

      Note: When you configure a RSPAN mirroring session, you should select this VLAN as the RSPAN VLAN.

  3. Click Add to add a SPAN or RSPAN mirroring session.
  4. Provide the mirror session information.

    • Session ID — Select the identifier for the mirroring session.
    • Session Type — Select the appropriate option.

      • Local Port Based — Copies Tx, Rx, or both Tx and Rx traffic from each port to the destination port.
      • Local VLAN Based — Copies traffic from the local VLAN to the destination port.
      • RSPAN Source Session — Uses a VLAN to copy traffic from a source port or a source VLAN to another device.
      • RSPAN Destination Session — Uses a VLAN to copy traffic from a destination port to another device.
  5. Based on the selected session type, specify the parameters for the session.

  6. Click Apply.

    This updates the running configuration.

To learn more about configuring port mirroring on the Cisco SGxxx Series devices, refer to the SG220-50P Switch documentation on the vendor website.