topic Port mirroring from gateway in Firewall and Security Management

Port mirroring from gateway

Lijo_mathai — Wed, 17 Apr 2019 03:03:22 GMT

Hi, Is there an option to mirror traffic from an interface on gateway to another interface, this is to pipe the traffic to a IDS appliance for log analysis. I would like to check the possible settings on R77.30.

Thanks

Re: Port mirroring from gateway

PhoneBoy — Wed, 17 Apr 2019 12:49:52 GMT

In R80.20 there is an option to mirror and forward decrypted HTTPS traffic the Security Gateway is doing HTTPS Inspection on.
Beyond that, we cannot mirror traffic to a different port, which is something a switch typically does.
We can operate on traffic received from a mirror port.

Re: Port mirroring from gateway

hughmcgauran — Fri, 07 Apr 2023 09:12:15 GMT

Looks like this is an option now - https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Quantum_SecurityGateway_Guide/Topics-FWG/Mirror-and-Decrypt.htm

Your Security Gateway/ Cluster / Security Group clones all traffic (including HTTPS without decryption) that passes through it, and sends it out of the designated physical interface.