Skip to main content
killhha
killhha
New Member
September 29, 2023
Solved

SPAN Mirroring Multiple Ports (FortiGate 101F)

  • September 29, 2023
  • 3 replies
  • 12770 views

I need to SPAN mirror all of my Fortigate 101F ports/VLANs out to a single interface for an IDS that works on passive network monitoring. I had seen that SPAN mirroring is supported, but I am horribly disappointed at its actual functionality. I have tried from both GUI and CLI, but it seems that the SPAN configurations only allow the monitoring of a single port at a time.

 

Is there no way to mirror multiple source ports out of a single port? Or better yet, mirror entire VLANs out of a single port, as would be configurable on a standard Cisco switch?

 

Thank you

Best answer by lgupta

Hello Killhha, Good day!

 

FortiGate being a firewall has limited capabilities on the SPAN function (as SPAN is a Switch functionality).

You can still do SPAN of Software Switch or Hardware Switches built into the FortiGate.

Please refer:

1. https://community.fortinet.com/t5/FortiGate/Technical-Note-SPAN-Port-Mirroring-using-ports-associated-to/ta-p/191137
2. https://community.fortinet.com/t5/FortiGate/Technical-Tip-SPAN-Port-Mirroring-using-ports-associated-to/ta-p/198276


thank you!

-lgupta

 

3 replies

lgupta
Staff
lguptaAnswer
Staff
October 1, 2023

Hello Killhha, Good day!

 

FortiGate being a firewall has limited capabilities on the SPAN function (as SPAN is a Switch functionality).

You can still do SPAN of Software Switch or Hardware Switches built into the FortiGate.

Please refer:

1. https://community.fortinet.com/t5/FortiGate/Technical-Note-SPAN-Port-Mirroring-using-ports-associated-to/ta-p/191137
2. https://community.fortinet.com/t5/FortiGate/Technical-Tip-SPAN-Port-Mirroring-using-ports-associated-to/ta-p/198276


thank you!

-lgupta

 

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
October 1, 2023

I wouldn't recommend do SPAN with softswitch for entire VLAN for all ports on a FGT, especial for semi-permanent operation. Or similar to any other FWs. It would impact its performance significantly. Instead, I would recommend doing it at the main/top level switch, which is designed to do that.

 

Toshi

lgupta
Staff
lgupta
Staff
October 1, 2023

Yeah. Absolutely Not.

 

Software Switch traffic is not offloaded by design. All the traffic will be handled by the CPU in that case. Hence, lowering the overall traffic performance.

 

Terms & ConditionsAccessibility statement