Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to set up a SPAN [port-mirror] port on our main router. The router is a Cisco 2821. The goal is to be able to troubleshoot Internet issues at the packet level, and it won't happen that often. Here are the ports:

GigabitEthernet0/0 - Connects to AT&T uplink equipment... some fiber converter box. GigabitEthernet0/1 - Connects to our Juniper firewall, then the rest of the network. FastEthernet0/0/0 ... FastEthernet0/1/3 - All of these FastEthernet ports are unused.

I was considering keeping the cables where they are and assigning a FastEthernet port as a SPAN port, but Cisco's IOS gives me the error that you cannot SPAN across multiple switch modules.

Then I was considering not using GigabitEthernet0/1, and instead going into FastEthernet0/0/0, with FastEthernet0/0/1 being the SPAN port. But you can't assign those ports IP addresses -- THEY ARE STRICTLY LAYER 2 PORTS.

So then I thought, I'll just keep the current setup but connect GigabitEthernet0/1 to FastEthernet0/0/0. Another FastEthernet port will connect to the Juniper, and yet another will be a SPAN port I can connect a laptop with Wireshark to.

But that looks so goofy, with a cable going from one port to another on the same router. And would that create some routing/switching loop? I've just never done something like that before.

Would this work, or is there a better way to do this? Thanks.

share|improve this question
Maybe I've been missing something in my networking studies but ALL switch ports are layer 2 ports. Also, port spanning is a layer 2 function. –  joeqwerty Nov 8 '12 at 22:22
Can you clarify which device fa0/0/0 is on? From gi0/1 on the cisco router you said that connects to a juniper firwall, is where a switch in between the Cisco 2821 router and juniper firewall and this is where fa0/0/0 is? –  jwbensley Nov 8 '12 at 22:32
Sure, fa0/0/0 is on the same device. The Cisco 2821 has two Gb ports and 8 fa ports. There is no switch between the router and firewall. –  armani Nov 9 '12 at 14:36

2 Answers 2

I don't know if it will work for you but you wont create a loop on the network as the gig ports are layer 3 and the fast Ethernet ports are layer 2. if you connected two fast ethernet ports together you could create a loop.

share|improve this answer
Can you explain what you mean when you say that the Gbe ports are layer 3 ports. Switch ports are most definitely layer 2, not layer 3. It's Gbe (e for Ethernet) not Gbi (i for IP). –  joeqwerty Nov 9 '12 at 1:38
Ok, thanks. I'll be able to give it a shot tonight. Will report back. –  armani Nov 9 '12 at 14:37
up vote 0 down vote accepted

For closure, I'm closing this question out. I didn't work further on it, because we coincidentally decided to install a SonicWall in its place for SSL-VPN purposes. Sorry for those of you needing a verified answer to this question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.