Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

HERBINET_Maxime
New Contributor

SPAN Mirror Processing

Hello all,

Is there some documentation regarding the amounth of processing resources required to enable SPAN / Port mirroring on different flavors of FortiSwitches ?
I have notice some high use of RAM (75%) even on FSW that are not heavily loaded.

What are the risk while enabling large numbers of src-ingress + src-egress ports ?
- Not enough CPU
- Not enough RAM
- Not enough bandwidth (in case of oversubscription) > what will be the consequences ?

Finally, is SPAN handle at ASIC level in FSW ? any documnetation about this?

Regards,

Maxime
1 REPLY 1
FortiSardinas_FTNT

I have not seen any data on this, but I would imagine this aligns with the FortiSwitch HW Limitations 

6.4.6 States that MAX EGRESS Session is 4 for the models above
https://docs.fortinet.com/document/fortiswitch/6.4.6/administration-guide/428704/mirroring



------------------------------
:man_office_worker: Adonis Sardinas
:globe_showing_americas: Systems Engineer - Latin America & Caribbean
:scroll:Certified: NSE 4, Fast Track Trainer, CISSP, CEH, CNDA, CCNA Cyber

☎ Tech Support: 1-866-648-4638 (us toll free)
More Support numbers: :link: http://www.fortinet.com/support/contact_support.html

:link:https://www.fortinet.com/support/contact_support.html
:link:https://support.fortinet.com
:link:https://docs.fortinet.com
:link:https://kb.fortinet.com
------------------------------
Adonis Sardinas
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.