Asset & Anomaly Detection - APCL logging

[TheRealDiZ]

Hey guys,

I just need some tips in order to start with an IoT deployment.

I need to gain informations about network traffic/protocol and app that are used in a specific environment.

Traffic is passing through R80.20 cluster.

The goal is to provide a better security for network traffic related to air conditioning systems/video surveillance systems.

Tried first to enable an ordered layer to log the application traffic with a rule :

For now it seems the firewall is only able to log "ICMP Proto" application.

So I'm assuming the layer is working properly and the app control is working properly as well.

By the way do you have any idea/tips?

Do you think that an AAD Management on a dedicated machine will help?

I was trying to to imagine a scenario where we configure a span port on the core switch in order to forward the traffic to AAD.

Do you think is it possible and is it a good idea in order to gain visibility?

Let me know guys I hope someone can share his experience in this area.

Thanks in advance

D!Z