Configuring A Capture Port - Cisco 6500 Series Software Configuration Manual

Configuring VLAN ACLs
This example shows how to define and apply a VLAN access map to forward IP packets. In this example,
IP traffic matching net_10 is forwarded and all other IP packets are dropped due to the default drop
action. The map is applied to VLAN 12 to 16.
Router(config)# vlan access-map thor 10
Router(config-access-map)# match ip address net_10
Router(config-access-map)# action forward
Router(config-access-map)# exit
Router(config)# vlan filter thor vlan-list 12-16
This example shows how to define and apply a VLAN access map to drop and log IP packets. In this
example, IP traffic matching net_10 is dropped and logged and all other IP packets are forwarded:
Router(config)# vlan access-map ganymede 10
Router(config-access-map)# match ip address net_10
Router(config-access-map)# action drop log
Router(config-access-map)# exit
Router(config)# vlan access-map ganymede 20
Router(config-access-map)# match ip address any_host
Router(config-access-map)# action forward
Router(config-access-map)# exit
Router(config)# vlan filter ganymede vlan-list 7-9
This example shows how to define and apply a VLAN access map to forward and capture IP packets. In
this example, IP traffic matching net_10 is forwarded and captured and all other IP packets are dropped:
Router(config)# vlan access-map mordred 10
Router(config-access-map)# match ip address net_10
Router(config-access-map)# action forward capture
Router(config-access-map)# exit
Router(config)# vlan filter mordred vlan-list 2, 4-6

Configuring a Capture Port

A port configured to capture VACL-filtered traffic is called a capture port.
Note To apply IEEE 802.1Q or ISL tags to the captured traffic, configure the capture port to trunk
unconditionally (see the
on page 7-9
To configure a capture port, perform this task:
Command
Step 1
Router(config)# interface {{type
Step 2
Router(config-if)# switchport capture allowed
vlan {add | all | except | remove} vlan_list
Router(config-if)# no switchport capture allowed
vlan
Step 3
Router(config-if)# switchport capture
Router(config-if)# no switchport capture
1. type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet
Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide—Release 12.1 E
23-16
"Configuring the Layer 2 Switching Port as an ISL or 802.1Q Trunk" section
and the "Configuring the Layer 2 Trunk Not to Use DTP" section on page
1
slot/port}
Chapter 23
Purpose
Specifies the interface to configure.
(Optional) With Release 12.1(13)E and later releases,
filters the captured traffic on a per-destination-VLAN
basis. The default is all.
Clears the configured destination VLAN list and returns
to the default value (all).
Configures the port to capture VACL-filtered traffic.
Disables the capture function on the interface.
Configuring Network Security
7-10).
78-14099-04