0

I am setting up a network monitoring device which recommends that I create a mirror interface on my firewall/security appliance and send all packets to the monitor for sniffing, logging, and correlation.

The device in question is a SonicWall TZ600, which can't currently handle the full 1Gbps WAN connection that it has. Traffic is slowed to around 800Mbps with the scanning features turned on.

I have read that port mirroring doesn't affect switch performance.

My question is if the additional load of setting up a mirror on this strained firewall will further constrict it's performance?

Improve this question
6
  • Yes, mirroring does add load to the switch, however, it's unlikely you'll notice it, assuming it's a real switch and not a software bridge. Hardware mirroring is usually lowest priority, so the switch will do everything else before copying traffic.
    – Ricky
    Commented Feb 27, 2019 at 0:31
  • It's a SonicWall router, not a switch. I'm not sure if it uses software bridging but it likely does.
    – HackSlash
    Commented Feb 28, 2019 at 16:19
  • 1
    Looks like X0 and X1 are non-switch, the other 8 ports are switched.
    – Ricky
    Commented Feb 28, 2019 at 16:24
  • Hmmm, so then the question becomes how do they implement the port mirror feature?
    – HackSlash
    Commented Feb 28, 2019 at 16:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Apr 19, 2019 at 14:43

1 Answer 1

Reset to default
1

You're trying to set up the IPS sniffing function on the SonicWall, mirroring LAN traffic from the switch into the SonicWall?

Since both WAN traffic scanning and IPS sniffing for LAN traffic uses the same engine that's rated at 500 Mbit/s, then yes, your firewall's performance is likely to suffer further.

The LAN traffic isn't impacted since it's only a mirrored stream from the switch. However, LAN traffic puts load on the inspection engine and since WAN traffic needs to pass through it, it'll be slowed down further.

Edit after comment "The TZ600 is where the mirror needs to be set up":

Reading the manual, I don't think the TZ600 supports mirroring one of its ports. However, you should connect a switch between the firewall and the WAN uplink (maybe include the firewall's LAN downlink across that switch as well) and use port mirroring there. That way there's no impact on the SonicWall.

Improve this answer
5
  • Sorry, no. The TZ600 is where the mirror needs to be set up so that I can listen to everything that happens in the network on my monitoring device. The monitoring device will be directly attached to the TZ600 on the interface set up as a mirror port. The question is about the additional load on the TZ600 created by the mirror interface.
    – HackSlash
    Commented Feb 26, 2019 at 22:09
  • "The TZ600 is where the mirror needs to be set up so that I can listen to everything that happens in the network on my monitoring device." Not all the network traffic passes through the firewall, so you cannot use it to monitor all network traffic, only the traffic passing through the firewall. To monitor traffic on your network, you need to mirror on the network switches because LAN traffic is delivered directly from host to host through the switches, not the firewall.
    – Ron Maupin ♦
    Commented Feb 26, 2019 at 22:13
  • Thanks @RonMaupin. I'm following the set up instructions for the monitoring device. Perhaps it is most interested in traffic that is traversing subnets.
    – HackSlash
    Commented Feb 26, 2019 at 22:20
  • @HackSlash, mirroring doesn't affect switch performance because switching is done in hardware. You firewall is going to use software for most things, so there is a big difference.
    – Ron Maupin ♦
    Commented Feb 26, 2019 at 22:24
  • @RonMaupin That's the closest thing to an answer so far.
    – HackSlash
    Commented Feb 28, 2019 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.