This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enable port mirroring on one interface of Sophos XG

Hello everybody,

we are testing a new SIEM and we don't have a managed switch. We would like to use one interface of Sophos XG for mirror all the traffic that passes through to our SIEM. Is this possible?

Regards,

Jose

This thread was automatically locked due to age.

Parents

0 lferrara over 8 years ago

Jose,

How is configured your XG? Bridge or routing mode?

I think that if it is working as bridge, adding a third nic will do the trick.

Anyway the best way to mirror traffic is to use span feature on switch. Strange that your switch is not span capable.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg CT over 8 years ago in reply to lferrara

You could do a tcpdump with the IP of your SIEM server and the grab the pcap and analyze it that way. Here is an excellent guide written by Emile:

https://community.sophos.com/products/xg-firewall/f/network-and-routing/73466/how-to-do-a-tcpdump-filedump-and-retrieve-it-by-ftp
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Greg CT over 8 years ago in reply to lferrara

You could do a tcpdump with the IP of your SIEM server and the grab the pcap and analyze it that way. Here is an excellent guide written by Emile:

https://community.sophos.com/products/xg-firewall/f/network-and-routing/73466/how-to-do-a-tcpdump-filedump-and-retrieve-it-by-ftp
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data