topic Palo Alto in Virtual wire vs TAP mode. in Next-Generation Firewall Discussions

Palo Alto in Virtual wire vs TAP mode.

Kandarp_Desai — Sun, 05 Feb 2023 10:46:20 GMT

Hello,
Just wanted to confirm my understanding on the different modes of deployment in PA.
Virtual Wire is an INLINE mode ( similar like IPS) and TAP mode is a passive monitoring mode.
So does that mean if I find an unlocked rack somewhere and I were to remove the ethernet from the switch/firewall in that rack and instead attach it to lets say ethernet1/1 on palo alto in a virtual wire mode, then connect ethernet 1/2 on the palo alto back to the port in the rack, then I can actually be snooping on all the traffic ? And more so not only snooping I can also block some traffic ? In TAP mode, it requires the switchport to be configured to TAP so I think I cannot snoop using TAP mode ?

Re: Palo Alto in Virtual wire vs TAP mode.

TomYoung — Sun, 05 Feb 2023 13:01:54 GMT

Hi @Kandarp_Desai ,

That is correct. You brought up some good thoughts which I will finish below:

VWire = virtual wire = inline = snoop = block = IPS
Tap = not inline = switch port setup for SPAN or port mirroring = still can snoop = cannot block = IDS

Yes, the easiest setup for VWire is between 2 network devices, such as the switch and the current firewall.

Thanks,

Tom

Re: Palo Alto in Virtual wire vs TAP mode.

Kandarp_Desai — Sun, 05 Feb 2023 17:26:02 GMT

Thanks for the reply Tom 🙂 Hope you have a most pleasant day!