Technical Tip: Change the destination MAC address for Mirror SSL traffic

• This setup involves creating a security or network policy where the mirror action is defined, and adjusting the Destination MAC to ensure that mirrored packets are correctly redirected to the monitoring device without disrupting the original traffic flow.
• Proper configuration ensures seamless SSL traffic duplication, facilitating effective monitoring while maintaining network security and performance.
• To change the Destination MAC Address for mirrored SSL traffic, you need to configure your network device, such as a switch or firewall, to modify the MAC address in the mirrored traffic.

• This is typically done through port mirroring or SPAN (Switched Port Analyzer) configurations combined with a feature like MAC address rewriting or a packet capture tool that supports packet modification.

Topology.

 Windows 1  (10.113.0.2) ---- Port2 --- FortiGate -- Port1 ---- Internet.

                                                                       |

                                                              Port3 (10.7.0.2).

                                                                       | 

                                                                       |

                                                      Windows Mirror User.

• ARP Table.

get system arp
Address Age(min) Hardware Addr Interface
10.7.0.2 0 00:62:65:6e:12:01 port3
10.113.0.2 0 00:62:65:6e:2e:01 port2
10.191.47.254 0 00:09:0f:09:64:1b port10
10.191.21.106 1 00:73:74:75:2f:01 port1
10.191.31.254 0 00:09:0f:09:64:1b port1

• To configure the SSL Mirroring, refer to the article: Technical Tip: Support SSL mirroring in proxy mode.

• Port 3 is configured to mirror all traffic originating from Port 2, meaning that any data sent or received on Port 2 will also be duplicated and sent to Port 3 for monitoring or analysis purposes.

•  A PCAP capturing traffic on Port 3 showing the destination MAC address 'ff:ff:ff:ff:ff:ff' indicates broadcast traffic, which is sent to all devices within the local network segment.
• This is common for network discovery protocols like ARP requests or DHCP broadcasts, where a device seeks to identify other devices or obtain configuration information.
• The presence of such broadcast frames on Port 3 suggests that either a device is actively searching for network resources or an essential network service is broadcasting information, and network administrators should verify if this broadcast traffic is expected or potentially indicative of network issues such as ARP storms or misconfigurations.

•   Changing the Mirror DST MAC address to '00:62:65:6e:12:01'.

config firewall decrypted-traffic-mirr
    edit "SSL+to_port3"
        set dstmac 00:62:65:6e:12:01
        set traffic-type ssl
        set traffic-source client
        set interface "port3"
    next
end

• A PCAP capture on Port 3, indicating a destination MAC address of '00:62:65:6e:12:01', suggests that network traffic destined for this MAC address is passing through or being observed on that port.