Can I use v-wire to receive mirror traffic and send to another device?

[JJNet_RoyWang]

Dear All,

The customer's  switch only can mirror traffic in one port.

Original mirror port is use for another security device.

      FW  

        |             SPAN

Core Switch----------> Security Monitor Device

       |

   Client

We want to use  look like below.

      FW  

        |             SPAN

Core Switch----------> Paloalto(V-wire) --------->Security Monitor Device

       |

   Client

Is it OK?

Best Regards,

Roy Wang.

[panos]

it should work

https://live.paloaltonetworks.com/message/8427#8427

[ssharma]

Hi Roy,

If your "Security Monitor Device" is the end device, ie. not connected to any other device in the network that should be fine. Vwire just acts as bump in the wire. When a packet is received from one of the vwire ports, it forwards it out its corresponding port. That means, same packet will be flowing through core switch to client (normal flow) and through PAN -> Sec. Monitor Device (Spanned traffic). If there are connections from Security Monitor Device to a switch or other devices that might cause a loop for the packets.

You can have 2 span ports from the switch (if possible) and use 1 of the interface on PAN as TAP mode and achieve same results. This configuration will not forward packets to Security Monitor Device though.

Hope this helps.

[jvalentine · Accepted solution]

I've done this before and it works great.  Just be sure that your v-wire isn't configured to drop any traffic.  Same thing with URL filtering, IPS/AV/Spyware signatures, DNS Signatures, etc - just make sure they're in "alert-only" mode.