Can I use v-wire to receive mirror traffic and send to another device?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Can I use v-wire to receive mirror traffic and send to another device?

L1 Bithead

Dear All,

The customer's  switch only can mirror traffic in one port.

Original mirror port is use for another security device.

      FW  

        |             SPAN

Core Switch----------> Security Monitor Device

       |

   Client

We want to use  look like below.

      FW  

        |             SPAN

Core Switch----------> Paloalto(V-wire) --------->Security Monitor Device

       |

   Client

Is it OK?

Best Regards,

Roy Wang.

1 accepted solution

Accepted Solutions

L7 Applicator

I've done this before and it works great.  Just be sure that your v-wire isn't configured to drop any traffic.  Same thing with URL filtering, IPS/AV/Spyware signatures, DNS Signatures, etc - just make sure they're in "alert-only" mode. 

View solution in original post

3 REPLIES 3

L6 Presenter

L5 Sessionator

Hi Roy,

If your "Security Monitor Device" is the end device, ie. not connected to any other device in the network that should be fine. Vwire just acts as bump in the wire. When a packet is received from one of the vwire ports, it forwards it out its corresponding port. That means, same packet will be flowing through core switch to client (normal flow) and through PAN -> Sec. Monitor Device (Spanned traffic). If there are connections from Security Monitor Device to a switch or other devices that might cause a loop for the packets.

You can have 2 span ports from the switch (if possible) and use 1 of the interface on PAN as TAP mode and achieve same results. This configuration will not forward packets to Security Monitor Device though.

Hope this helps.

L7 Applicator

I've done this before and it works great.  Just be sure that your v-wire isn't configured to drop any traffic.  Same thing with URL filtering, IPS/AV/Spyware signatures, DNS Signatures, etc - just make sure they're in "alert-only" mode. 

  • 1 accepted solution
  • 2554 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!