Deploy Cisco Cyber Vision Sensor on Switches and Routers

PDF

Deploy Cisco Cyber Vision Sensor on Switches and Routers

Setting up OT traffic monitoring

Updated: September 8, 2026

Want to summarize with AI?

Log in

Guides you through setting up OT traffic monitoring on Cisco switches and routers, including VLAN configuration, VTP management, SPAN-based traffic mirroring, AppGigabitEthernet setup, and secure communication via NAT and external IPs for integration with Cyber Vision Center.

Setting up traffic monitoring on switches and routers is essential for a Cisco Cyber Vision sensor to perform Deep Packet Inspection (DPI) on network traffic and securely send data to the Cyber Vision Center.

Summary

The goal of this configuration is to ensure that the Cyber Vision sensor receives a complete and accurate copy of network traffic for analysis, and can securely send the data to Cyber Vision Center. The data is then contextually organized in the Center, enabling you to effectively monitor your OT and IT assets and respond to any potential risks.

Workflow

  1. Configure VLANs

    VLANs are the building blocks of any modern network. When you configure VLANs, you ensure that OT devices and relevant IT traffic are properly defined and ready for monitoring.You can then view traffic data by VLAN ID in the Cyber Vision Center, gaining visibility of your operational environment.

  2. (IE3300 and IE3400 Switches Only) Disable VTP mode

    VTP can automatically propagate VLAN configurations across a network. Disabling VTP mode on the monitoring switch helps prevent unintended VLAN changes that could disrupt the monitoring setup.

  3. Configure monitoring sessions

    Monitoring sessions are core mechanisms for traffic mirroring, and typically use Switched Port Analyzer (SPAN)-based methods. This step involves setting up a session to copy traffic from specific source ports or VLANs to a designated destination port where the Cyber Vision sensor is connected. This allows the sensor to passively inspect all relevant traffic without affecting network performance or operations.

    Note

    • If you want to mirror by port in IE3300 and IE3400 devices, you must mirror all the ports. Port mirroring only supports ingress packets, leaving egress packets unmonitored. Mirroring all ports ensures all communications are mirrored and monitored.

    • In the case of VLAN mirroring, LLDP and CDP traffic may not be captured.

  4. (All switches and IR8340 routers) Configure AppGigabitEthernet

    The AppGigabitEthernet interface allows switches to connect to the IOx application, Cyber Vision sensor. Proper configuration ensures that the interface is ready to receive the mirrored traffic efficiently and can handle the data throughput required for DPI.

  5. Configure External Communication

    • (Switches only) Assign an external IP address

      A Switch Virtual Interface (SVI) is a virtual Layer 3 interface on a multilayer switch that serves as the default gateway for a specific VLAN, enabling communication and routing between VLANs. Setting up SVI provides an external IP for the switch. The IP address is used by the Cyber Vision Center to deploy the sensor application on a device using the sensor management extension.

    • Configure NAT

      If the Cyber Vision sensor is located in a private network segment and needs to communicate with the Cyber Vision Center over a public network or a different private segment, NAT configuration is crucial. It translates the sensor's private IP address to a routable address, enabling secure and successful communication with the Cyber Vision Center for data transmission.

      Routers and specific switches (IE3500, IE9300, Catalyst 9x00) use classic NAT.

      The IE3300 and IE3400 switches use a specially designed Layer 3 NAT (L3NAT) method. L3NAT is supported by these switches if they run IOX-XE 17.14.1 or later releases. You can only configure L3NAT for Cyber Vision use on these switches, as the NAT method is not broadly supported on the devices. L3NAT only allows supports static translation of UDP and TCP packets, and requires a Network Advantage license.

Result

The network is configured to mirror OT traffic for deep packet inspection via the Cyber Vision Sensor, with appropriate segmentation, security, and monitoring fidelity from the intended OT network segments to the Cyber Vision Center.

Configure traffic monitoring on the switches

Before you begin

This task flow provides an overview of the various steps to collect the traffic information that the Cyber Vision sensor can inspect, analyze, and send to the Cyber Vision Center. Based on the switch you use and the mirroring and monitoring techniques you want to employ, refer to these configuration guides for detailed configuration examples:

In this task, the configuration examples aim to configure mirroring on VLAN 2508 and collection on VLAN 507.

Procedure

  1. Use the configure terminal command to enter the global configuration mode.

  2. (For IE3300 and IE3400 devices) Use the vtp mode off command to disable VTP.

  3. Use the vlan <vlan ID> command to create a mirror VLAN (VLAN 2508) and a collection VLAN (VLAN 507).

    Switch series Configuration example
    IE3300 and IE3400 (RSPAN must be enabled on the mirror VLAN as ERSPAN is not directly supported.) 
    
switch(config)#vlan 2508
switch(config)#remote-span
switch(config)#exit
switch(config)#vlan 507
    IE3500, IE9300, Catalyst 9x00 
    
switch(config)#vlan 2508
switch(config)#vlan 507

  4. Use the monitor session command to define monitoring sessions.

    Switch series Configuration example
    IE3300 and IE3400 
    
!To configure physical port monitoring
switch#conf t
switch(config)# interface vlan 2508
switch(config)# ip address 169.254.1.1 255.255.255.252
switch(config)#monitor session 1 source interface Gi1/3 - 10 both
switch(config)#monitor session 1 destination remote vlan 2508
switch(config)#monitor session 1 destination format-erspan <cyber-vision-sensor-capture-ip> 

!To configure vlan monitoring 
switch#conf t
switch(config)# interface vlan 2508
switch(config)# ip address 169.254.1.1 255.255.255.252
switch(config)#monitor session 1 source vlan 1 rx
switch(config)#monitor session 1 destination remote vlan 2508
switch(config)#monitor session 1 destination format-erspan <cyber-vision-sensor-capture-ip>
    IE3500, IE9300, Catalyst 9x00 
    !Example that defines an ERSPAN source session with header and destination parameters
switch#conf t
switch(config)# interface vlan 2508
switch(config)# ip address 169.254.1.1 255.255.255.252
switch(config)#monitor session 1 type erspan-source
switch(config)#source interface Gi1/11 both
switch(config)#no shutdown
switch(config)#header-type 3  !Use this command for Cyber Vision Sensors release 5.5.0 and later, on IE9300 and Catalyst 9x00 switches
switch(config)# destination
switch(config)#i erspan-id 2
switch(config)# ip address <erspan-destination-ip-address>
switch(config)#mtu 9000 
switch(config)#origin ip address <origin-ip-address>
switch(config)#exit

  5. Configure AppGigabitEthernet port to enable communication with the IOx application, the Cyber Vision sensor.

    Switch type Configuration example
    IE3300, IE3400, IE3500 
    switch#configure terminal
switch(config)#interface AppGigabitEthernet 1/1
switch(config)#switchport mode trunk
switch(config)#switchport trunk allowed vlan <collection-vlan>,<mirror-vlan>,<monitored-vlan>
switch(config)#switchport trunk native vlan <approved-native-vlan>
switch(config)#no shutdown
switch(config)#exit
    IE9300, Catalyst 9300, Catalyst 9400 
    switch#configure terminal
switch(config)#interface AppGigabitEthernet 1/0/1
switch(config)#switchport mode trunk
switch(config)#switchport trunk allowed vlan <collection-vlan>,<mirror-vlan>,<monitored-vlan>
switch(config)#switchport trunk native vlan <approved-native-vlan>
switch(config)#no shutdown
switch(config)#exit
    Note

    In IE9300, Catalyst 9300 and Catalyst 9400 switches, if you want to use VLAN1 for sensor communication, assign a different VLAN to carry untagged traffic by using the command switch(config)#switchport trunk native vlan <existing-vlan-ID>.

  6. Enable external communication by configuring switchport access (external IP) for the collection VLAN, or setting up NAT, or both.

    External communication method Configuration example
    L3NAT for IE3300 and IE3400 switches 
    !Define a private IP for the sensor application to act as its default gateway.
Switch(config)#int vlan <vlan-ID>
Switch(config-if)#ip address <ip-address> <subnet-mask>

!Define a management SVI IP address for the switch.
Switch(config)#int vlan 507
Switch(config-if)#ip address <ip-address> <subnet-mask>

!Configure L3NAT-IOx.
Switch(config)#l3nat-iox
Switch(config-iox-nat)#app-ip <private-IP> svi-ip <svi-ip> app-name <sensor app name> server-ip <cyber-vision-center-IP>
    NAT for IE3500, IE9300, and Catalyst 9x00 switches 
    Switch#enable
Switch#configure terminal
Switch(config)#ip access-list standard CCV-NAT
Switch(config-std-nacl)#permit <sensor-collection-subnet> <wildcard-mask>
Switch(config-std-nacl)#exit
Switch(config)#interface <inside-interface>
Switch(config-if)#ip address <inside-ip> <mask>
Switch(config-if)#ip nat inside
Switch(config-if)#exit
Switch(config)#interface <outside-interface>
Switch(config-if)#ip address <outside-ip> <mask>
Switch(config-if)#ip nat outside
Switch(config-if)#exit
Switch(config)#ip nat inside source list CCV-NAT interface <outside-interface> overload
Switch(config)#ip route 0.0.0.0 0.0.0.0 <outside-next-hop>
Switch(config)#end

  7. Use the write mem command to save these settings to the switch’s startup configuration.

Configure traffic monitoring on routers

Of the supported routers, IR8340 is unique in hosting switched ports. The IR8340 supports switched-port traffic monitoring and uses three distinct application paths:

  • VirtualPortGroup 0 (VPG0) is the routed ERSPAN capture path.

  • VirtualPortGroup 1 (VPG1) is the collection and NAT path to the Cyber Vision Center.

  • AppGigabitEthernet 0/1/1 is the switched-port capture path.

If you want to monitor traffic from switched ports on IR8340, begin with step 2.

The IR1101 and IR1800 do not support the switched-port AppGigabitEthernet path. For these routers, begin with the routed VirtualPortGroup configuration in Step 3.

Procedure

  1. Use the configure terminal command to enter the global configuration mode.

  2. (IR8340 only) Configure a VLAN and an AppGigabitEthernet port to mirror traffic from switched ports.

    The VLAN number must be between 2340 and 2349, the range reserved for internal system uses such as IOx application hosting and ERSPAN traffic.

    Example:

    #Configure VLAN
vlan 2340
exit
interface vlan 2340
ip address 169.254.2.1 255.255.255.252
no shutdown
exit

#Configure AppGigabitEthernet port
interface AppGigabitEthernet 0/1/1
switchport mode trunk
exit

  3. For routing ports, connect the application to a VirtualPortGroup and assign it an IP address to create a destination for the ERSPAN traffic.

    Example:

    
ip routing
interface virtualportgroup 0
ip address 169.254.1.1 255.255.255.252
exit

  4. Configure a monitor session for the ERSPAN traffic

    Option Description
    For routing ports 
    
monitor session 5 type erspan-source
source interface Gi0/0/0 
no shutdown
destination erspan-id 1 
mtu 1464
ip address 169.254.1.2
origin ip address 169.254.1.1
end
    For switching ports 
    monitor session 1 type erspan-source
source interface Gi0/1/0 - 10 both 
no shutdown
destination erspan-id 2 
mtu 9000
ip address 169.254.2.2
origin ip address 169.254.2.1
exit

  5. Configure NAT to enable the sensor application to reach the Cyber Vision Center.

    Example:

    Configure terminal
interface GigabitEthernet 0/0/0
ip nat outside
media-type rj45
exit
interface VirtualPortGroup 1
ip address 169.254.0.1 255.255.255.252
ip nat inside
exit
ip nat inside source list NAT_ACL interface GigabitEthernet 0/0/0 overload
ip access-list standard NAT_ACL
10 permit 169.254.0.0 0.0.0.3
exit