Here's a few ideas:
1. Private VLAN Edge & Rerouting
There's a old feature of Cisco switches called "Private VLAN Edge" (see https://www.cisco.com/en/US/tech/tk389/tk814/tk841/tsd_technology_support_sub-protocol_home.html).
Think of it as "hotel mode", where you want to keep your guests' system from talking to each other, but everyone may talk to the router.
The feature is restricted to a single switch (or stack-of-switches), and it doesn't really work across multiple switches.
I cant' actually test this right now, but it might be worth some consideration:
- set all switchports of the given 3560G to "protected", except the port where router & inline device are connected.
- make sure that the router is re-routing incoming packets back out through the interface they came from, if source/dest are within the given subnet. There might be a performance impact, als all intra-VLAN traffic will now hairpin through the inline device and the router.
That should make all Intra-VLAN traffic visible to the device. That might be a bit more than was intended in the first place, so...
2. PVLAN Edge, Dynamic VLAN assignment & looping two VLANs
An entirely different approach might be someting along these lines:
- define two VLANs on the Switch.
- Let VLAN "A" be the regular VLAN where everyone is allowed to talk to each other and the router.
- Let VLAN "B" be the special VLAN, whose communication must go through the inline device.
- Ports of VLAN B should run as PVLAN Edge "protected" ports (except the port where the inline device is connected).
- implement a solution that maps MAC addresses from a given list to VLAN B. 802.11x, a CISCO ISE, MAB and port templates might be too steep a mountain to climb, but will help to dynamically configure ports as needed.
- Another approach might be (custom) smart port macros: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swmacro.html#wp1238054 . The user defined port macro in question should not only set the port to "switchport access vlan B", but also as "switchport protected".
- of course, static/manual mapping of a (set of) ports to VLAN "B" works, too, but isn't as dynamic as I assume you want it to be.
- on the switch, connect the inline device's switch facing port to a *non-*protected port of VLAN B.
- on the switch, connect the inline device's router facing port to a port of VLAN A. A switching loop should not occur, as long as the inline devices' switchports are "switchport mode access" into different VLANs and without bpduguard.
Now whenever a host with a MAC-address-of-interest connects to any of the ports, it's switchport gets mapped into VLAN B, and to reach anyone else on the subnet (other MACs-of-Interest included) it must go through the inline device. MAC learning and ARPing should be "native" for all systems involved.
3. Dynamic VLAN Assignment & Auto SPAN Port
If the inline device is just intended for analyzing traffic (and not for manipulating or blocking), a custom smart port macro (see above) might just be running a user defined macro that adds another line of "monitor session 1 source interface 0/Y", as soon as a MAC address of interest is discovered on a given port. Of course, you'd need a "cleanup macro" as well, that runs after "line protocol down" of a given switch port.
4. Dynamic VLAN Assignment & SPANning one VLAN
Use a mixed approach of 2. and 3.
Port Macros assign host of interest to VLAN B. Connect both VLAN A and VLAN B to a pair of bridged ports on the router (as above, two interfaces & BVI, or better two-ports-on-switch-module & SVI).
Connect the inline device to a SPAN destination port on the switch, and use VLAN B as SPAN source. Whatever talks on VLAN B will be visible to the now passive inline device.