SPAN Mirroring Multiple Ports (FortiGate 101F)

[killhha]

I need to SPAN mirror all of my Fortigate 101F ports/VLANs out to a single interface for an IDS that works on passive network monitoring. I had seen that SPAN mirroring is supported, but I am horribly disappointed at its actual functionality. I have tried from both GUI and CLI, but it seems that the SPAN configurations only allow the monitoring of a single port at a time.

Is there no way to mirror multiple source ports out of a single port? Or better yet, mirror entire VLANs out of a single port, as would be configurable on a standard Cisco switch?

Thank you

[lgupta · Accepted solution]

Hello Killhha, Good day!

FortiGate being a firewall has limited capabilities on the SPAN function (as SPAN is a Switch functionality).

You can still do SPAN of Software Switch or Hardware Switches built into the FortiGate.

Please refer:

1. https://community.fortinet.com/t5/FortiGate/Technical-Note-SPAN-Port-Mirroring-using-ports-associate...
2. https://community.fortinet.com/t5/FortiGate/Technical-Tip-SPAN-Port-Mirroring-using-ports-associated...

thank you!

-lgupta

[Toshi_Esumi]

I wouldn't recommend do SPAN with softswitch for entire VLAN for all ports on a FGT, especial for semi-permanent operation. Or similar to any other FWs. It would impact its performance significantly. Instead, I would recommend doing it at the main/top level switch, which is designed to do that.

Toshi

[lgupta]

Yeah. Absolutely Not.

Software Switch traffic is not offloaded by design. All the traffic will be handled by the CPU in that case. Hence, lowering the overall traffic performance.