topic Re: Network Packet Broker in General Topics

Network Packet Broker

santonic — Fri, 13 Aug 2021 10:05:36 GMT

Can network packet broker feature (in PAN-OS 10.1) be used only to mirror some traffic and not expect any return traffic? Like port mirror on switch.

Re: Network Packet Broker

Remo — Fri, 13 Aug 2021 20:43:23 GMT

Hi @santonic

As far as I understood, this is not possible. There is only the decrypt-port-mirror-feature on the firewall which allows you to forward decrypted traffic over a mirror port on the firewall.

Re: Network Packet Broker

santonic — Mon, 16 Aug 2021 07:40:50 GMT

Yeah, that is my understanding as well. But I am a bit surprised it's not possible as it would be the easier option to implement I guess.

Re: Network Packet Broker

Remo — Mon, 16 Aug 2021 10:18:12 GMT

I guess as this feature is available also on the cheapest switches (implemented in hardware), the focus of paloalto wasn't on something like this.

Re: Network Packet Broker

santonic — Mon, 16 Aug 2021 10:25:40 GMT

Yeah, probably. But with all the PA features for writing policy rules (app-id, user-id, zones, rule based profiles...) the mirroring options here would be far superior to any switch.