Deploy Cisco Cyber Vision Sensor on Switches and Routers

Setting up OT traffic monitoring

Updated: June 23, 2026

Want to summarize with AI?

Guides you through setting up OT traffic monitoring on Cisco switches and routers, including VLAN configuration, VTP management, SPAN-based traffic mirroring, AppGigabitEthernet setup, and secure communication via NAT and external IPs for integration with Cyber Vision Center.

Setting up traffic monitoring on switches and routers is essential for a Cisco Cyber Vision sensor to perform Deep Packet Inspection (DPI) on network traffic and securely send data to the Cyber Vision Center.

Summary

The goal of this configuration is to ensure that the Cyber Vision sensor receives a complete and accurate copy of network traffic for analysis, and can securely send the data to Cyber Vision Center. The data is then contextually organized in the Center, enabling you to effectively monitor your OT and IT assets and respond to any potential risks.

Workflow

Configure VLANs VLANs are the building blocks of any modern network. When you configure VLANs, you ensure that OT devices and relevant IT traffic are properly defined and ready for monitoring.You can then view traffic data by VLAN ID in the Cyber Vision Center, gaining visibility of your operational environment.
(IE3300 and IE3400 Switches Only) Disable VTP mode VTP can automatically propagate VLAN configurations across a network. Disabling VTP mode on the monitoring switch or relevant interfaces helps prevent unintended VLAN changes that could disrupt the monitoring setup.
Configure monitoring sessions Monitoring sessions are core mechanisms for traffic mirroring, and typically use Switched Port Analyzer (SPAN)-based methods. This step involves setting up a session to copy traffic from specific source ports or VLANs to a designated destination port where the Cyber Vision sensor is connected. This allows the sensor to passively inspect all relevant traffic without affecting network performance or operations.
Note
- If you want to mirror by port in IE3400 and IE3400 devices, you must mirror all the ports. Port mirroring only supports ingress packets, leaving egress packets unmonitored. Mirroring all ports ensures all communications are mirrored and monitored.
- In the case of VLAN mirroring, LLDP and CDP traffic may not be captured.
(All switches and IR8340 routers) Configure AppGigabitEthernet The AppGigabitEthernet interface allows switches to connect to the IOx application, Cyber Vision sensor. Proper configuration ensures that the interface is ready to receive the mirrored traffic efficiently and can handle the data throughput required for DPI.
Configure External Communication
- (Switches only) Assign an external IP address A Switch Virtual Interface (SVI) is a virtual Layer 3 interface on a multilayer switch that serves as the default gateway for a specific VLAN, enabling communication and routing between VLANs. Setting up SVI provides an external IP for the switch. The IP address is used by the Cyber Vision Center to deploy the sensor application on a device using the sensor management extension.
- Configure NATIf the Cyber Vision sensor is located in a private network segment and needs to communicate with the Cyber Vision Center over a public network or a different private segment, NAT configuration is crucial. It translates the sensor's private IP address to a routable address, enabling secure and successful communication with the Cyber Vision Center for data transmission.Routers and specific switches (IE3500, IE9300, Catalyst 9x00) use classic NAT.The IE3300 and IE3400 switches use a specially designed Layer 3 NAT (L3NAT) method. L3NAT is supported by these switches if they run IOX-XE 17.14.1 or later releases. You can only configure L3NAT for Cyber Vision use on these switches, as the NAT method is not broadly supported on the devices. L3NAT only allows supports static translation of UDP and TCP packets, and requires a Network Advantage license.

Result

The network is configured to mirror OT traffic for deep packet inspection via the Cyber Vision Sensor, with appropriate segmentation, security, and monitoring fidelity from the intended OT network segments to the Cyber Vision Center.

Configure traffic monitoring on the switches

Before you begin

This task flow provides an overview of the various steps to collect the traffic information that the Cyber Vision sensor can inspect, analyze, and send to the Cyber Vision Center. Based on the switch you use and the mirroring and monitoring techniques you want to employ, refer to these configuration guides for detailed configuration examples:

In this task, the configuration examples aim to configure mirroring on VLAN 2508 and collection on VLAN 507.

Procedure

Use the configure terminal command to enter the global configuration mode.

(For IE3300 and IE3400 devices) Use the vtp mode off command to disable VTP.

Use the vlan <vlan ID> command to create a mirror VLAN (VLAN 2508) and a collection VLAN (VLAN 507).

Switch series	Configuration example
IE3300 and IE3400 (RSPAN must be enabled on the mirror VLAN as ERSPAN is not directly supported.)	`switch(config)#vlan 2508 switch(config)#remote span switch(config)#exit switch(config)#vlan 507`
IE3500, IE9300, Catalyst 9x00	`switch(config)#vlan 2508 switch(config)#vlan 507`

Use the monitor session command to define monitoring sessions.

Switch series Configuration example

IE3300 and IE3400


!To configure physical port monitoring
switch#conf t
switch(config)#monitor session 1 source interface Gi1/3 - 10 both
switch(config)#monitor session 1 destination remote vlan 2508
switch(config)#monitor session 1 destination format-erspan <cyber-vision-sensor-capture-ip> 

!To configure vlan monitoring 
switch#conf t
switch(config)#monitor session 1 source vlan 1 rx
switch(config)#monitor session 1 destination remote vlan 2508
switch(config)#monitor session 1 destination format-erspan <cyber-vision-sensor-capture-ip>

IE3500, IE9300, Catalyst 9x00

!Example that defines an ERSPAN source session with header and destination parameters
switch#conf t
switch(config)#monitor session 1 type erspan-source
switch(config)#source interface Gi1/11 both
switch(config)#no shutdown
switch(config)#header-type 3
switch(config)#destination erspan-id 2 ip address <erspan-destination-ip-address>
switch(config)#mtu 9000 
switch(config)#origin ip address <origin-ip-address>
switch(config)#exit

Configure AppGigabitEthernet port to enable communication with the IOx application, the Cyber Vision sensor.

Switch type Configuration example

IE3300, IE3400, IE3500

switch#configure terminal
switch(config)#interface AppGigabitEthernet 1/1 
switch(config)#switchport mode trunk
switch(config)#exit

IE9300, Catalyst 9300, Catalyst 9400

switch#configure terminal
switch(config)#interface AppGigabitEthernet 1/0/1
switch(config)#switchport mode trunk
switch(config)#switchport trunk native vlan <existing-vlan-ID>
switch(config)#exit

Enable external communication by configuring switchport access (external IP) for the collection VLAN, or setting up NAT, or both.

External communication method Configuration example

L3NAT for IE3300 and IE3400 switches

!Define a private IP for the sensor application to act as its default gateway.
Switch(config)#int vlan <vlan-ID>
Switch(config-if)#ip address <ip-address> <subnet-mask>

!Define a management SVI IP address for the switch.
Switch(config)#int vlan 507
Switch(config-if)#ip address <ip-address> <subnet-mask>

!Configure L3NAT-IOx.
Switch(config)#l3nat-iox
Switch(config-iox-nat)#app-ip <private-IP> svi-ip <svi-ip> app-name <sensor app name> server-ip <cyber-vision-center-IP>

NAT for IE3500, IE9300, and Catalyst 9x00 switches

enable
switch#configure terminal
switch(config)#interface port-channel <inside-interface-ID>
switch(config)#ip address <ip-address> <subnet-mask> [secondary]
switch(config)#ip nat inside
switch(config)#exit
switch(config)#interface port-channel <outside-interface-ID>
switch(config)#ip address <ip-address> <subnet-mask> [secondary]
switch(config)#ip nat outside
switch(config)#exit
end

Use the write mem command to save these settings to the switch’s startup configuration.

Configure traffic monitoring on routers

Of the supported routers, IR8340 is unique in hosting switched ports. If you want to monitor traffic from switched ports on IR8340, carry out step 2.

If you are configuring IR1101 or IR1800, start this task at Step 3.

Procedure

Use the configure terminal command to enter the global configuration mode.

(IR8340 only) Configure a VLAN and an AppGigabitEthernet port to mirror traffic from switched ports.

The VLAN number must be between 2340 and 2349, the range reserved for internal system uses such as IOx application hosting and ERSPAN traffic.

Example:

#Configure VLAN
vlan 2340
exit
interface vlan 2340
ip address 169.254.2.1 255.255.255.252
no shutdown
exit

#Configure AppGigabitEthernet port
interface AppGigabitEthernet 0/1/1
switchport mode trunk
exit

For routing ports, connect the application to a VirtualPortGroup and assign it an IP address to create a destination for the ERSPAN traffic.

Example:


ip routing
interface virtualportgroup 0
ip address 169.254.1.1 255.255.255.252
exit

Configure a monitor session for the ERSPAN traffic

Option Description

For routing ports


monitor session 5 type erspan-source
source interface Gi0/0/0 
no shutdown
destination erspan-id 1 
mtu 1464
ip address 169.254.1.2
origin ip address 169.254.1.1
end

For switching ports

monitor session 1 type erspan-source
source interface Gi0/1/0 - 10 both 
no shutdown
destination erspan-id 2 
mtu 9000
ip address 169.254.2.2
origin ip address 169.254.2.1
exit

Configure NAT to enable the sensor application to reach the Cyber Vision Center.

Example:

Configure terminal
interface GigabitEthernet 0/0/0
ip nat outside
media-type rj45
exit
interface VirtualPortGroup 1
ip address 169.254.0.1 255.255.255.252
ip nat inside
exit
ip nat inside source list NAT_ACL interface GigabitEthernet 0/0/0 overload
ip access-list standard NAT_ACL
10 permit 169.254.0.0 0.0.0.3
exit

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.