Tap Interfaces

Decide which port you want to use as your tap interface and connect it to a switch configured with SPAN/RSPAN or port mirroring.
You will send your network traffic from the SPAN destination port through the firewall so you can have visibility into the applications and threats on your network.
From the firewall web interface, configure the interface you want to use as your network tap.
Select
Network
Interfaces
and select the interface that corresponds to the port you just cabled.
Select
Tap
as the
Interface Type
.
On the
Config
tab, expand the
Security Zone
and select
New Zone
.
In the Zone dialog, enter a
Name
for new zone, for example TapZone, and then click
OK
.
(Optional)
Create any forwarding profiles you want to use.
Configure a Log Forwarding profile
Configure Syslog Monitoring
Create Security Profiles to scan your network traffic for threats:
Select
Objects
Security Profiles
.
For each security profile type,
Add
a new profile and set the action to
alert
.
Because the firewall is not inline with the traffic you cannot use any block or reset actions. By setting the action to alert, you will be able to see any threats the firewall detects in the logs and ACC.
Create a security policy rule to allow the traffic through the tap interface.
When creating a security policy rule for tap mode, both the source zone and destination zone must be the same.
Select
Policies
Security
and click
Add
.
In the
Source
tab, set the
Source Zone
to the TapZone you just created.
In the
Destination
tab, set the
Destination Zone
to the TapZone also.
Set the all of the rule match criteria (
Applications
,
User
,
Service
,
Address
) to
any
.
In the
Actions
tab, set the
Action Setting
to
Allow
.
Set
Profile Type
to
Profiles
and select each of the security profiles you created to alert you of threats.
Verify that
Log at Session End
is enabled.
Click
OK
.
Place the rule at the top of your rulebase.
Commit
the configuration.
Monitor the firewall logs (
Monitor
Logs
) and the
ACC
for insight into the applications and threats on your network.