Cisco Systems 7600 SERIES manual Configuring a Capture Port, 23-16

Chapter 23 Configuring Network Security

Configuring VLAN ACLs

This example shows how to define and apply a VLAN access map to forward IP packets. In this example, IP traffic matching net_10 is forwarded and all other IP packets are dropped due to the default drop action. The map is applied to VLAN 12 to 16.

Router(config)# vlan access-map thor 10

Router(config-access-map)# match ip address net_10

Router(config-access-map)# action forward

Router(config-access-map)# exit

Router(config)# vlan filter thor vlan-list 12-16

This example shows how to define and apply a VLAN access map to drop and log IP packets. In this example, IP traffic matching net_10 is dropped and logged and all other IP packets are forwarded:

Router(config)# vlan access-map ganymede 10

Router(config-access-map)# match ip address net_10

Router(config-access-map)# action drop log

Router(config-access-map)# exit

Router(config)# vlan access-map ganymede 20

Router(config-access-map)# match ip address any_host

Router(config-access-map)# action forward

Router(config-access-map)# exit

Router(config)# vlan filter ganymede vlan-list 7-9

This example shows how to define and apply a VLAN access map to forward and capture IP packets. In this example, IP traffic matching net_10 is forwarded and captured and all other IP packets are dropped:

Router(config)# vlan access-map mordred 10

Router(config-access-map)# match ip address net_10

Router(config-access-map)# action forward capture

Router(config-access-map)# exit

Router(config)# vlan filter mordred vlan-list 2, 4-6

Configuring a Capture Port

A port configured to capture VACL-filtered traffic is called a capture port.

Note To apply IEEE 802.1Q or ISL tags to the captured traffic, configure the capture port to trunk unconditionally (see the “Configuring the Layer 2 Switching Port as an ISL or 802.1Q Trunk” section on page 7-8and the “Configuring the Layer 2 Trunk Not to Use DTP” section on page 7-9).

To configure a capture port, perform this task:

	Command	Purpose
Step 1
	Router(config)# interface {{type1 slot/port}	Specifies the interface to configure.
Step 2
	Router(config-if)#switchport capture allowed	(Optional) With Release 12.1(13)E and later releases,
	vlan {add all except remove} vlan_list	filters the captured traffic on a per-destination-VLAN
		basis. The default is all.
	Router(config-if)#no switchport capture allowed	Clears the configured destination VLAN list and returns
	vlan	to the default value (all).
Step 3
	Router(config-if)# switchport capture	Configures the port to capture VACL-filtered traffic.
	Router(config-if)#no switchport capture	Disables the capture function on the interface.

1.type = ethernet, fastethernet, gigabitethernet, or tengigabitethernet

	Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.1E
23-16	78-14064-04