Mirror VPN traffic terminated into Sophos XG running 17.5.12 MR-12

Hi Steve Gyurindak,

Thank you for reaching out to Sophos Community.

Steve Gyurindak said:

mirror (SPAN) traffic terminated from VPN connections to an interface in an Sophos XG

Could you please share some more insight on this?

The customer has many vpn connections that terminate at the Sophos firewall, they then go out the port connected to the provider's CPE.  So their traffic never enters the internal network.  We are looking to pull a copy of all the traffic leaving the firewall going to the providers network.  Is there a way to mirror that traffic to another port on the firewall so it can be ingested by the Armis collector?

The customer has many vpn connections that terminate at the Sophos firewall, they then go out the port connected to the provider's CPE.  So their traffic never enters the internal network.  We are looking to pull a copy of all the traffic leaving the firewall going to the providers network.  Is there a way to mirror that traffic to another port on the firewall so it can be ingested by the Armis collector?

I guess mirroring the VPN traffic would not be possible as it's encrypted.

Can you give a bit more information on how traffic goes out the port connected to the provider's CPE?

It would be great if you share a rough network diagram.

Here is a concept of what is happening