Port mirroring

IeM,

XG can be deployed in TAP mode using wizard. Do not use custom commands like you did.

community.sophos.com/.../122971

Thanks

Hi,

That’s not for what I am looking for. That article describes to deploy XG in discover mode using a TAP interface with the specific goal: generate security reports from the XG.

I also read that I need to enable port mirroring on the switch. But doing that is not what I am looking for. Especially because switches with span/mirror ports always give ‘other’ traffic priority and this can lead to missing packets. Someting that’s very crucial when it becomes to mirroring.

IeM, sorry but I did not understand the question.

Can you explain better your goal?

Thanks

Hi Luk,

All traffic that is being processed (in- and outgoing) should be copied/duplicated to another (monitoring) machine in the network. This should be done on IP address level. Normally this could be established by using iptables and mangle/tee.

Regards

Ilias

Hi Luk,

All traffic that is being processed (in- and outgoing) should be copied/duplicated to another (monitoring) machine in the network. This should be done on IP address level. Normally this could be established by using iptables and mangle/tee.

Regards

Ilias

Ok, so you wish to mirror traffic processed by XG to another appliance, correct?

This is not possible.

Please vote the feature request:

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/13315812-decryption-port-mirroring

Thanks

Hi,

Thanks for pointing to the feature request.

But I keep this post open as:

- I am aware that it should be possible to arrange this in the mean time in user space (or probably kernel space);

- Feature request is almost two years open.

Regards,

Ilias.