Can I use v-wire to receive mirror traffic and send to another device?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L1 Bithead

Can I use v-wire to receive mirror traffic and send to another device?

Dear All,

The customer's  switch only can mirror traffic in one port.

Original mirror port is use for another security device.

      FW  

        |             SPAN

Core Switch----------> Security Monitor Device

       |

   Client

We want to use  look like below.

      FW  

        |             SPAN

Core Switch----------> Paloalto(V-wire) --------->Security Monitor Device

       |

   Client

Is it OK?

Best Regards,

Roy Wang.


Accepted Solutions
Highlighted
L7 Applicator

I've done this before and it works great.  Just be sure that your v-wire isn't configured to drop any traffic.  Same thing with URL filtering, IPS/AV/Spyware signatures, DNS Signatures, etc - just make sure they're in "alert-only" mode. 

View solution in original post


All Replies
Highlighted
L6 Presenter

L5 Sessionator

Hi Roy,

If your "Security Monitor Device" is the end device, ie. not connected to any other device in the network that should be fine. Vwire just acts as bump in the wire. When a packet is received from one of the vwire ports, it forwards it out its corresponding port. That means, same packet will be flowing through core switch to client (normal flow) and through PAN -> Sec. Monitor Device (Spanned traffic). If there are connections from Security Monitor Device to a switch or other devices that might cause a loop for the packets.

You can have 2 span ports from the switch (if possible) and use 1 of the interface on PAN as TAP mode and achieve same results. This configuration will not forward packets to Security Monitor Device though.

Hope this helps.

Highlighted
L7 Applicator

I've done this before and it works great.  Just be sure that your v-wire isn't configured to drop any traffic.  Same thing with URL filtering, IPS/AV/Spyware signatures, DNS Signatures, etc - just make sure they're in "alert-only" mode. 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!