They do in fact have 'magic' VLAN number. You can see it with 'show vlan internal usage' though if I understood documentation right that shouldn't be an issue...
On Thu, Dec 19, 2013 at 5:24 PM, Randy <[email protected]> wrote: > Hi, > > Indeed, I've mirrored all the ACL entries. That isn't the issue. > > The problem is when you have egress traffic over a physical L3 interface > rather than another VLAN. > > Let's say I've got only VLAN's 2 - 250 active and configured for hosts > with WAN ports on physical L3 interfaces and I want to monitor all traffic > between VLAN 91 and the internet (L3 WAN ports) and my ACL's are correct. > > The following show only inbound traffic from WAN->VLAN: > > (config-if)#switchport capture allowed vlan 91 > > (config-if)#switchport capture allowed vlan 2-250 > > (config-if)#switchport capture allowed vlan 1-1000 > > > Auto-magically, the 'all' statement includes L3 WAN ports and now you get > both sides of the traffic: > > > (config-if)#switchport capture allowed vlan all > > So, the L3 ports have some 'magic' VLAN number or is this a bug/feature of > the 'all' statement? > > Sadly, if I understand it correctly, the 'all' keyword means I can only > have a single ACL active -- no ability to set up another capture port with > a different VACL. > > ~Randy > > > > On 12/19/2013 6:45 am, Andriy Bilous wrote: > > Could it be that you're using only one direction in IP ACLs bound to > VACL? E.g. > > permit any 10.0.0.0 > > instead of > > permit 10.0.0.0 any > permit any 10.0.0.0 > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
