Example-1: This configuration defines a SPAN (Switched Port Analyzer) filter group. It creates a filter group named FILTER-GROUP-1 with a description and a single entry ENTRY-1. This entry matches TCP traffic from source IP 20.20.20.20 (ports 80–81) to destination IP 10.10.10.10 (ports 1–65535). This allows you to monitor or capture only specific network traffic that matches these criteria for troubleshooting or analysis.
apic:
access_policies:
span:
filter_groups:
- name: FILTER-GROUP-1
description: My SPAN Filter Group 1
entries:
- name: ENTRY-1
destination_ip: 10.10.10.10
destination_from_port: 1
destination_to_port: 65535
source_ip: 20.20.20.20
source_from_port: 80
source_to_port: 81
ip_protocol: tcp
Example-2: This second example demonstrates how to define a filter group with multiple entries, each targeting different types of traffic and hosts, and is suitable for use cases where you want to monitor or troubleshoot specific application flows in your network
Filter Group Name: WEB-TRAFFIC-FILTER. This filter group is designed to capture web (HTTP/HTTPS) and SSH traffic between specific hosts.
Entries:
WEB-ENTRY Matches TCP traffic from source IP 192.168.1.10 to destination IP 172.16.0.5. Source ports: 1024–65535 (typical ephemeral port range). Destination ports: 80–443 (covers HTTP and HTTPS). Only TCP protocol is matched. Useful for monitoring web traffic from a specific client to a web server.
SSH-ENTRY Matches TCP traffic from source IP 10.0.0.2 to destination IP 10.0.0.100. Destination port: 22 (SSH). Only TCP protocol is matched. Useful for monitoring SSH access from a specific management host to a server.
apic:
access_policies:
span:
filter_groups:
- name: WEB-TRAFFIC-FILTER
description: Filter for web and SSH traffic from specific sources
entries:
- name: WEB-ENTRY
source_ip: 192.168.1.10
destination_ip: 172.16.0.5
source_from_port: 1024
source_to_port: 65535
destination_from_port: 80
destination_to_port: 443
ip_protocol: tcp
- name: SSH-ENTRY
source_ip: 10.0.0.2
destination_ip: 10.0.0.100
destination_from_port: 22
destination_to_port: 22
ip_protocol: tcp
Location in GUI: Fabric » Access Policies » Policies » Troubleshooting » SPAN » SPAN Filter Groups
