WSA L4TM SPAN Question

[Freemen]

Hi All,

I have a explicit deployment with pac file, and proxy 12.5 to turn on ip spoofing feature.

my setup is as below, so my enable L4TM i will SPAN the uplink GI0/1 destination to the T1 port? does only SPAN uplink is enough? and does it will work with ip spoofing + explicit mode?

[balaji.bandi · Accepted solution]

From my notes :

The L4TM monitors traffic , commonly via a SPAN (Switch Prot Analyzer) port from a switch, also called port mirroring.

In Duplex mode, you only use T1, to monitor the incoming and outgoing traffic. So T1 is connected to a SPAN port that sees both traffic incoming and outgoing.

In Simplex mode, you use T1 for the outbound traffic, and T2 for the inbound traffic. So SPAN the outgoing VLAN to a port connected to T1, and SPAN the incoming VLAN to a port connected to T2.

Q: What is the difference between L4TM Simplex and duplex modes?
A: There are two modes that the L4TM interfaces can be configured to use: Simplex and Duplex. This can be configured in GUI -> "Network" -> "Interfaces" -> "L4 Traffic Monitor Wiring".

Duplex mode:
In this mode, both directions of traffic are being spanned to a single L4TM interface (T1/T2) interface.

Simplex mode:
In this mode, client traffic out is sent to T1 and return traffic to the client is sent to T2.

[Freemen · Accepted solution]

so i SPAN Gi0 and choose Duplex mode should be fine?

can you advise how to test? any URL can trigger this L4TM ? and action drop to be observe?