I have two VLANs, VLAN1 for "clients" and VLAN2 for (web)servers. Both VLANs have two ports in etherchannel (one Cisco switch). I would like to put transparent (WAF) device in bridge mode between the VLANs in order to monitor/block traffic. What could be the method in order to accomplish this in case of Cisco device (or eliminate this kind of problem).

For example if I use two physical switches, and connect the trunk ports (and bonded) via the transparent device bridge interfaces I can see the traffic.

Im curios about, is it possible to do in one switch between VLANs, if yes what the name or method i should search for?

Thank you!

  • 1
    If you bridge two VLANs, they become one VLAN. Perhaps transparent mode is not what you want.
    – Ron Trunk
    Oct 27 '17 at 14:16
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Feb 21 '18 at 16:26

As Ron Trunk pointed out, bridging VLANs can be problematic in the results. Cisco offers SPAN for network monitoring. You can mirror the traffic from on or more interfaces or VLANs to an interface to which you connect your monitoring equipment. There is also RSPAN that lets you transport the the mirrored traffic across layer-2 to a different switch, and ERSPAN (for select equipment) that will encapsulate the mirrored traffic so that it can cross layer-3.

Understanding SPAN,RSPAN,and ERSPAN

Local SPAN: Mirrors traffic from one or more interface on the switch to one or more interfaces on the same switch.

Remote SPAN (RSPAN): An extension of SPAN called remote SPAN or RSPAN. RSPAN allows you to monitor traffic from source ports distributed over multiple switches, which means that you can centralize your network capture devices. RSPAN works by mirroring the traffic from the source ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN session. This VLAN is then trunked to other switches, allowing the RSPAN session traffic to be transported across multiple switches. On the switch that contains the destination port for the session, traffic from the RSPAN session VLAN is simply mirrored out the destination port.

Encapsulated remote SPAN (ERSPAN): encapsulated Remote SPAN (ERSPAN), as the name says, brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains.

ERSPAN is a Cisco proprietary feature and is available only to Catalyst 6500, 7600, Nexus, and ASR 1000 platforms to date. The ASR 1000 supports ERSPAN source (monitoring) only on Fast Ethernet, Gigabit Ethernet, and port-channel interfaces.

To control traffic between the VLANs, you use something like an ACL on the router that routes traffic between the VLANs.

  • If I understand the OP, he wants to filter traffic, putting the WAF "between" the VLANs.
    – Ron Trunk
    Oct 27 '17 at 15:33
  • Would that be off-topic as application-layer protocols?
    – Ron Maupin
    Oct 27 '17 at 15:37
  • I think the question is more like "where to put this device in my network," which I consider on topic.
    – Ron Trunk
    Oct 27 '17 at 15:46
  • Is RSPAN better way to monitor for continuous long time. As per my understanding, It capture the traffic and we analyse Pcap files. It may have memory limitations for continuous monitoring. I think except firewall, it is impossible to control or monitor traffic in high production environment. Jun 29 '18 at 0:53
  • @JatinderBrar, that depends on what you want. RSPAN has nothing to do with controlling traffic, it is a tool to troubleshoot network problems by capturing all the frames within a given context. For monitoring network trends, there are other tools like NetFlow (IPFIX). For controlling traffic, you need something like a firewall, but you will need to put a layer-2 firewall in the direct path of all the traffic on a layer-2 network. That is particularly difficult on a switched network where frames are delivered directly from the source host to the destination host.
    – Ron Maupin
    Jun 29 '18 at 1:05

You can bridge two VLANs on one switch by physically connecting them with the WAF.


You could split the VLAN of webservers to two VLAN with different subnets, for example create two /25 from one /24. And bridge together via the firewall "bump on the wire". But how to solve this it's swtich or networking device specific. I think it's possible with Cisco Catalyst, but unfortunatley I haven't found appropriate diagram.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.