Needed confirmation on firewall Port spanning or port mirroring

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Needed confirmation on firewall Port spanning or port mirroring

L3 Networker

Dear Team,

 

As per the customer requirement we want to perform Port spanning or port mirroring on the firewall interface so we need confirmation whether it is recommended from Palo Alto and if we perform this will there be any impact on the firewall as firewall is in production at data center or is there any alternate method for this.

 

Request your immediate help on this.

 

Regards

Karthikeyan Balamurugan

3 REPLIES 3

L3 Networker

Customer requirement is SPAN traffic from Palo Alto on temporary basis to perform POC on NAC.

SPAN the traffic as mentioned below, so that a cable will be connected from Palo Alto to the server to get mirrored traffic from router zone.

 

Source                  : Security Zone – Palo Alto (ae1.120)

Destination         : Security Zone – NAC POC SPAN (To be created and assign to any free Ethernet physical interface(1000Mbps))

 

Note : Make sure that production traffic is not disturbed.

@karthikeyanB 

This is not possible, you can't span from the firewall to somewhere else

The only thing that comes close is the decryption port mirror, but that applies only to decrypted ssl/tls

 

Alternatively you can log export syslog which could feed a NAC user-ip mappings

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L2 Linker

I agree with @reaper  that firewall doesnt support port spanning in itself but you can go for one alternative which I always prefer.

Span the port of switch which is connected to firewall interface you want to monitor and then connect the mirrored port to your server . It  will more or less serve you the same purpose.

Hope it helps ..Cheers !

  • 3445 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!