Decrypted Traffic Mirror questions

[echo]

Hello!

I want to implement Decrypted Traffic Mirror feature but I haven't seen a Fortinet document that would explain the Destination MAC meaning. What is it?

1a. The MAC for the webserver whose decrypted traffic will be mirrored?

1b. The MAC for the capturing server which captures the decrypted SSL traffic? It is more likely this case because the same GUI window also needs a port to send the decrypted traffic to.

2. If the given example with ff:ff:ff:ff:ff:ff works for all cases then what is the meaning of those f's? Is it a filter or exact-match value? What changes when I replace that part with ff:ff:ff:ff:ff:f0 or any other real value? I guess that depends on the answer from the first question. Why isn't there an IP-address instead, whichever case it is (1a or 1b)? Is there anything to do with mirroring the traffic to multiple servers and all f's send this traffic to all servers behind the physical/virtual port?

[jintrah_FTNT · Accepted solution]

Hi,

Yes, you are right. The mac address is a broadcast address so that any host behind the mirrored port interface could get the traffic. You can configure with a real value too if intended only to be send to one specific host for reception.

Best regards,

Jin

[echo]

Thank you for information. So I understand it means this:

1. All f's means "MAC-broadcast": any server behind the port gets the traffic.

2. Anything else is only a specific MAC and only server with this MAC will get the decrypted traffic.

[jintrah_FTNT]

Yes, that's absolutely correct!

best regards,

Jin