You can now collect data for devices whose traffic doesn’t pass through a firewall by mirroring their traffic on network switches and sending it to the firewall through an Encapsulated Remote Switched Port Analyzer (ERSPAN) tunnel. After the firewall decapsulates the traffic, PAN-OS logs the traffic the same as if it had terminated on a TAP port. The firewall then sends the logs to the logging service where IoT Security accesses and analyzes it.