A network tap is a device that provides a way to access data flowing across a computer network. Tap mode deployment allows you to passively monitor traffic flows across a network by way of a switch SPAN or mirror port.
The SPAN or mirror port permits the copying of traffic from other ports on the switch. By dedicating an interface on the firewall as a tap mode interface and connecting it with a switch SPAN port, the switch SPAN port provides the firewall with the mirrored traffic. This provides application visibility within the network without being in the flow of network traffic.
By deploying the firewall in tap mode, you can get visibility into what applications are running on your network without having to make any changes to your network design. In addition, when in tap mode, the firewall can also identify threats on your network. Keep in mind, however, because the traffic is not running through the firewall when in tap mode it cannot take any action on the traffic, such as blocking traffic with threats or applying QoS traffic control.
To configure a tap interface and begin monitoring the applications and threats on your network:
- Decide which port you want to use as your tap interface and connect it to a switch configured with SPAN/RSPAN or port mirroring.You will send your network traffic from the SPAN destination port through the firewall so you can have visibility into the applications and threats on your network.
- From the firewall web interface, configure the interface.
- Selectand select the interface that corresponds to the port you just cabled.NetworkInterfaces
- SelectTapas theInterface Type.
- On theConfigtab, expand theSecurity Zonedrop-down and selectNew Zone.
- In the Zone dialog, enter aNamefor new zone, for example TapZone, and then clickOK.
- Create Security Profiles to scan your network traffic for threats:
- Select.ObjectsSecurity Profiles
- For each security profile type,Adda new profile and set the action toalert.Because the firewall is not inline with the traffic you cannot use any block or reset actions. By setting the action to alert, you will be able to see any threats the firewall detects in the logs and ACC.
- Create a security policy rule to allow the traffic through the tap interface.When creating a security policy rule for tap mode, both the source zone and destination zone must be the same.
- Selectand clickPoliciesSecurityAdd.
- In theSourcetab, set theSource Zoneto the TapZone you just created.
- In theDestinationtab, set theDestination Zoneto the TapZone also.
- Set the all of the rule match criteria (Applications,User,Service,Address) toany.
- In theActionstab, set theAction SettingtoAllow.
- SetProfile TypetoProfilesand select each of the security profiles you created to alert you of threats.
- Verify thatLog at Session Endis enabled.
- Place the rule at the top of your rulebase.
- Committhe configuration.
- Monitor the firewall logs () and theMonitorLogsACCfor insight into the applications and threats on your network.
Tap Interface Network > Interfaces > Ethernet You can use a tap interface to monitor traffic on a port. To configure a tap interface, click ...
Configure SSL Inbound Inspection
SSL Inbound Inspection decryption enables the firewall to see potential threats in inbound encrypted traffic destined for your servers and apply security protections against those ...
Common Building Blocks for Firewall Interfaces
Common Building Blocks for Firewall Interfaces Select Network Interfaces to display and configure the components that are common to most interface types. For a description ...
Configure Interfaces A Palo Alto Networks next-generation firewall can operate in multiple deployments at once because the deployments occur at the interface level. For example, ...
Configure QoS for a Virtual System
Configure QoS for a Virtual System QoS can be configured for a single or several virtual systems configured on a Palo Alto Networks firewall. Because ...
Building Blocks of Security Zones
Building Blocks of Security Zones To define a security zone, click Add and specify the following information. Security Zone Settings Description Name Enter a zone ...
Configure Decryption Port Mirroring
Where permitted by law, you can decrypt traffic and send the cleartext (unencrypted) traffic to a device that can archive and analyze the traffic. ...
Set Up Antivirus, Anti-Spyware, and Vulnerability Protectio...
Set Up Antivirus, Anti-Spyware, and Vulnerability Protection Every Palo Alto Networks next-generation firewall comes with predefined Antivirus , Anti-Spyware , and Vulnerability Protection profiles that ...
Create a Decryption Policy Rule
Decryption policy rules granularly define the traffic to decrypt or not to decrypt based on the source, destination, service (application port), and URL Category. ...