topic Re: Can you create a span/mirror port on Firepower 1010 using the FMC in Network Security

Can you create a span/mirror port on Firepower 1010 using the FMC

errMsg — Sun, 06 Sep 2020 02:41:39 GMT

Is it possible to create a span/mirror port on the Firepower 1010 device using the FMC console? I am using the firewall in routed mode but want all the network traffic to be mirrored on one port so I can do some traffic analysis with the security onion.

Re: Can you create a span/mirror port on Firepower 1010 using the FMC

Mohammed al Baqari — Sun, 06 Sep 2020 07:19:44 GMT

Hi,

Port spanning can't be configured on firepower. This is done at the switch
level. You can configure passive interfaces on firepower to act as IDS.

**** please remember to rate useful posts

Re: Can you create a span/mirror port on Firepower 1010 using the FMC

errMsg — Sun, 06 Sep 2020 13:00:51 GMT

I tried to make one port passive but I didnt see any traffic on it. I have 5 routed networks on the firepower device. I have the passive port connected to an esxi server.

Re: Can you create a span/mirror port on Firepower 1010 using the FMC

Marvin Rhoads — Sun, 06 Sep 2020 14:44:52 GMT

Are you sure the traffic is leaving the ESXi server on that port? That's by far the most likely cause of an issue such as you describe.

Re: Can you create a span/mirror port on Firepower 1010 using the FMC

errMsg — Sun, 06 Sep 2020 15:40:54 GMT

I was thinking that the firewall would be the one sending ALL the traffic to the passive port. From there I would connect from the firewall "Span" port >>>>to the computer's 2nd network interface I was going to use for analysis.

Re: Can you create a span/mirror port on Firepower 1010 using the FMC

Mohammed al Baqari — Sun, 06 Sep 2020 18:49:56 GMT

Hi, the firewall can't forward the traffic internally from routed port to
passive port. You need to do this using a switch.

*** please remember to rate useful posts