topic Re: TAP interface questions in General Topics

TAP interface questions

VSU_ITSEC — Mon, 04 Apr 2016 14:51:14 GMT

I'd like to monitor a portion of my network on my failover PA in TAP mode.

Will this affect my HA pair at all?

Is it possible to set up an aggregate TAP of 2 ports?

thanks in advance...

Re: TAP interface questions

Raido_Rattameister — Mon, 04 Apr 2016 18:06:11 GMT

Do you mean that passive firewall in active/passive cluster would perform monitoring (have TAP port listening)?

You can't do that because as name says - it is passive. Network ports are turned off on that fw.

Re: TAP interface questions

rmonvon — Mon, 04 Apr 2016 21:42:55 GMT

Also, yes you can place 2 tap ports across 2 aggregated links. Just make sure to put both tap ports on the same security zone.

Re: TAP interface questions

T.XuanDung — Sun, 11 Jan 2026 03:59:27 GMT

On the Cisco device, two interfaces (Ethernet 1 and Ethernet 2) are configured as part of the same aggregated link (Port-Channel 1).
SPAN is configured with the source VLANs 1–100 and the destination interface Port-Channel 1, as shown below:

monitor session 1 source vlan 1-100
monitor session 1 destination interface port-channel 1

On the Palo Alto device, the corresponding two interfaces (port 1 and port 2) are configured in TAP mode to receive the mirrored traffic from the Cisco device.

The question is: when SPAN traffic is sent out via a Port-Channel, can the Palo Alto device correctly receive and process the TAP traffic across these two interfaces?