ASA 5505 Monitor Ports - For IDS/IPS/Snort etc
Posted by: Rich in Config. Guides, Tricks and TipsThis is quite an interesting feature, and one that you wouldnt usually expect on a device like this.
Basically, when running IDS/IPS/Snort or any other packet sniffer in promiscuous mode, you need a way to “mirror” traffic from your hosts, to your IDS box. With Cisco switches, this is achieved through the use of the “monitor” commands, which set up Cisco SPAN ports (Switch Port Analyzer).
I needed to do some lab work and didnt have a Cisco switch at home, so looked through the documentation for my 5505. I was suprised to find out that It supports SPAN ports too!! This thing really is a box of tricks.
The config is simple, but first you need to decide which ports to mirror traffic from, and which port to send it to.
In my case, I wanted to mirror traffic from both eth0/0 and eth0/1 and send this to port eth0/5 where my IPS sensor was sat.
The commands used were as follows:
RichASA5505# conf t
RichASA5505(config)# int e0/5
RichASA5505(config-if)# switchport monitor ethernet0/1
RichASA5505(config-if)# switchport monitor ethernet0/2
Thats all there is to it. All traffic sent or received by hosts on port 0/1 and 0/2 will now be seen on port 0/5. Very useful if you want to keep tabs on what your small office workers are up to!

Entries (RSS)
January 17th, 2008 at 3:51 am
Excellent! I can’t believe I didn’t know this.
Great tip!
January 17th, 2008 at 10:02 pm
I was quite suprised to find the feature too
Was certainly very useful for my MARS/IPS lab!
Thanks for stopping by
June 25th, 2008 at 3:31 am
Can you suggest an easy way to verify the mirroring is happening? I’m trying to debug a Websense install and I want to make sure the ASA configuration is not the issue.
July 9th, 2008 at 9:05 am
Probably the quickest would be to plug a laptop into the destination port with Wireshark installed and start a capture. You should see the raw packets in Wireshark. Its a free application anyway, not to mention very useful!
The config I posted is tested as working so it should be fine, there isnt really a lot to go wrong with it.
Let us know how you get on.
Cheers,