I've got a client that is gonna have a Connectwise SIEM (Perch) sensor placed in the network.
Normally the internal Fortigate Port on the Switch is being mirrored. But with this client the Internal Port is also the FortiLink to Fortiswitche(s). The Port where the Fortigate is connected is port 48.
How can I create A mirror port on Port 48, without breaking the FortiLink to the FortiSwitches?
The Perch Sensor is connected on Port 30.
Hello,
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Thanks,
Hello,
We are still looking for someone to help you.
We will come back to you ASAP.
Regards,
Hi,
If I'm reading and understanding this correctly, you should be able to configure a RSPAN directly on the FortiSwitch not pushed from the FGT, https://community.fortinet.com/t5/FortiSwitch/Troubleshooting-Tip-Unable-to-setup-capture-for-port-c...
User | Count |
---|---|
1923 | |
1144 | |
769 | |
447 | |
277 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.