Palo Alto in Virtual wire vs TAP mode.

[Kandarp_Desai]

Hello,
Just wanted to confirm my understanding on the different modes of deployment in PA.
Virtual Wire is an INLINE mode ( similar like IPS) and TAP mode is a passive monitoring mode.
So does that mean if I find an unlocked rack somewhere and I were to remove the ethernet from the switch/firewall in that rack and instead attach it to lets say ethernet1/1 on palo alto in a virtual wire mode, then connect ethernet 1/2 on the palo alto back to the port in the rack, then I can actually be snooping on all the traffic ? And more so not only snooping I can also block some traffic ? In TAP mode, it requires the switchport to be configured to TAP so I think I cannot snoop using TAP mode ? 

[TomYoung · Accepted solution]

Hi @Kandarp_Desai ,

That is correct.  You brought up some good thoughts which I will finish below:

1. VWire = virtual wire = inline = snoop = block = IPS
2. Tap = not inline = switch port setup for SPAN or port mirroring = still can snoop = cannot block = IDS

Yes, the easiest setup for VWire is between 2 network devices, such as the switch and the current firewall.

Thanks,

Tom

[Kandarp_Desai]

Thanks for the reply Tom 🙂 Hope you have a most pleasant day!