topic Re: Can I use v-wire to receive mirror traffic and send to another device? in General Topics

Can I use v-wire to receive mirror traffic and send to another device?

JJNet_RoyWang — Fri, 01 Nov 2013 10:22:12 GMT

Dear All,

The customer's switch only can mirror traffic in one port.

Original mirror port is use for another security device.

| SPAN

Core Switch----------> Security Monitor Device

Client

We want to use look like below.

| SPAN

Core Switch----------> Paloalto(V-wire) --------->Security Monitor Device

Client

Is it OK?

Best Regards,

Roy Wang.

Re: Can I use v-wire to receive mirror traffic and send to another device?

Retired Member — Fri, 01 Nov 2013 11:59:00 GMT

it should work

https://live.paloaltonetworks.com/message/8427#8427

Re: Can I use v-wire to receive mirror traffic and send to another device?

ssharma — Fri, 01 Nov 2013 13:46:05 GMT

Hi Roy,

If your "Security Monitor Device" is the end device, ie. not connected to any other device in the network that should be fine. Vwire just acts as bump in the wire. When a packet is received from one of the vwire ports, it forwards it out its corresponding port. That means, same packet will be flowing through core switch to client (normal flow) and through PAN -> Sec. Monitor Device (Spanned traffic). If there are connections from Security Monitor Device to a switch or other devices that might cause a loop for the packets.

You can have 2 span ports from the switch (if possible) and use 1 of the interface on PAN as TAP mode and achieve same results. This configuration will not forward packets to Security Monitor Device though.

Hope this helps.

Re: Can I use v-wire to receive mirror traffic and send to another device?

jvalentine — Fri, 01 Nov 2013 13:50:29 GMT

I've done this before and it works great. Just be sure that your v-wire isn't configured to drop any traffic. Same thing with URL filtering, IPS/AV/Spyware signatures, DNS Signatures, etc - just make sure they're in "alert-only" mode.