I need to SPAN mirror all of my Fortigate 101F ports/VLANs out to a single interface for an IDS that works on passive network monitoring. I had seen that SPAN mirroring is supported, but I am horribly disappointed at its actual functionality. I have tried from both GUI and CLI, but it seems that the SPAN configurations only allow the monitoring of a single port at a time.
Is there no way to mirror multiple source ports out of a single port? Or better yet, mirror entire VLANs out of a single port, as would be configurable on a standard Cisco switch?
I wouldn't recommend do SPAN with softswitch for entire VLAN for all ports on a FGT, especial for semi-permanent operation. Or similar to any other FWs. It would impact its performance significantly. Instead, I would recommend doing it at the main/top level switch, which is designed to do that.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.