Hi all,
In scenario with two location connected via ipsec tunnel, remote office is accessing internet through wan port in main office, is it possible to capture and send traffic, remote office - internet and vice versa traffic, to analysis sensor?
Something like port mirroring in L2 world.
Thank you,
Drazen
That wouldn't be so easy in the way you want to duplicate the specific traffic and send it to a physical port. Because once the traffic hit the FSW you have it's encapsulated&encrypted. So it has to be duplicated before hitting/after coming out of the IPSec interface inside of the FGT.
One thing I can think of as possibility is setting up sflow on the IPsec interface to the IP for the monitoring device. The IPsec interface itself seem to accepts the sflow config so it should work. But don't know if it's before or after the encapsulation/encryption. I almost never used sflow before.
Also I'm almost sure you have to disable ASIC offloading on the IPSec policies.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-sFlow/ta-p/196930
Toshi
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
