topic SPAN or Mirror Port in Maestro in Hyperscale Firewall (Maestro)

SPAN or Mirror Port in Maestro

maxtaan — Wed, 26 Feb 2025 11:36:19 GMT

Hello Mates!!

Is configuring a SPAN/Mirror port from the MHO or within a Maestro setup possible? If so, could you provide the relevant configuration steps and any official documentation or SecureKnowledge (SK) articles?

Looking forward to your expert guidance.

Thanks in advance.

Re: SPAN or Mirror Port in Maestro

AkosBakos — Wed, 26 Feb 2025 11:58:27 GMT

Hi @maxtaan

Here is the common guide of monitor port. https://support.checkpoint.com/results/sk/sk101670

To configure Monitor Mode on a 40000 / 60000 Scalable Platform or Maestro that runs an R80SP.20 or higher release, refer to the corresponding R80SP.X Scalable Platforms Administration Guide, or Maestro Next Generation Security Gateway R80.20SP Guide - Chapter 'Deploying a Security Group in Monitor Mode'.

I hope it make sense.

Akos

Re: SPAN or Mirror Port in Maestro

Chris_Atkinson — Wed, 26 Feb 2025 12:00:28 GMT

To clarify do you want the system to originate or receive the mirrored traffic?

Would this not be possible from the adjacent network elements?

Re: SPAN or Mirror Port in Maestro

maxtaan — Thu, 27 Feb 2025 05:27:05 GMT

Hello @Chris_Atkinson

It may be possible from the adjacent network elements, but I want to send mirror traffic to QRADAR. There are different switches between the MZ and DMZ firewalls, but the MHO is the same. If we do it from switch some additional ports will be needed from both switches. That's why I want to do port mirroring from MHO. How can I achieve it? If yes, how? Please suggest.

Thanks

Re: SPAN or Mirror Port in Maestro

Chris_Atkinson — Thu, 27 Feb 2025 05:39:45 GMT

Would suggest consulting with your local SE regarding the suitability of Mirror and Decrypt

Re: SPAN or Mirror Port in Maestro

delToro1 — Thu, 27 Feb 2025 14:08:47 GMT

Hello, in one customer I have this configuration. They have to fordward all the traffic to a specific server in L2. I use one UPLINK port, create one new layer in the top of the policy only for mirror purposes. Using rules, you can decide which traffic send to monitor port, you can check that on the picture.

This is the documentation:

Gateway configuration:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/Mirror-and-Decrypt.htm?TocPath=Mirror%20and%20Decrypt%7C_____0

SmartConsole configuration: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/Mirror-and-Decrypt-Configuring-in-Gateway-mode-SmartConsole.htm?TocPath=Mirror%20and%20Decrypt%7CConfiguring%20Mirror%20and%20Decrypt%20in%20Gateway%20mode%7C_____2

Re: SPAN or Mirror Port in Maestro

CheckPointerXL — Tue, 13 Jan 2026 10:02:05 GMT

hi chris

is m&d suitable with bond? not clear from docs, it seems only phisical interface, but the bond are selectable into the pane

Re: SPAN or Mirror Port in Maestro

PhoneBoy — Tue, 13 Jan 2026 17:22:51 GMT

I don't see why it wouldn't work with a bond interface.