Mirror traffic from tunnel interfaces to SPAN port

[edevansky]

Hello Everyone,

I'm new to the PA firewall's and trying to figure out how to monitor my tunnel interfaces, and the traffic flowing through them.

I have a PA-3020 running as an endpoint for several tunnels. I want to mirror the traffic from those tunnels when it hits the PA before it is routed and offload it to a specific interface port. I've done just this on a Cisco device, but it seems a bit more complex on the PA.

How can I go about setting this up.

Thanks, Eric

[HULK]

Hello Edevansky,

Could you please explain, how you did this on CISCO device. Accordingly, we can think about an approach here in PAN firewall to achieve the goal.

Thanks

[mizhou]

Hi Eric,

Are you talking about doing a port mirroring (SPAN) on the PAN firewall for IPSec tunnel interface?

As far as I know this function is not available at this moment, so you may need to file a feature request through your local SE.

[tasonibare]

As mzh mentioned, this feature is not supported on the PAN at this time.

A feature request (ID 1307) has been filed for this functionality and you could request that your local SE vote on it as well.

Regards,

tasonibare

[jloehndorf]

Hello,

So from reading this you can't mirror a port on a PAN to another port?

[hshah]

Hi Hndorf,

PANW do not support SPAN, at max you can do packet capture on the interface.

There is a open Feature Request for the same. Contact SE to vote for you.

Priority: Medium

FR ID: 1307

Regards,

Hardik Shah