Configuring Mirror Settings

This section describes how to configure Packet Monitor mirror settings. Mirror settings provide a way to send packets to a different physical port of the same firewall or to send packets to, or receive them from, a remote SonicWall network security appliance.

To configure mirror settings

1. Navigate to the Tools & Monitors > Packet Monitor page.
2. Select the General tab.
3. Select the Mirror tab.
4. In the Mirror Settings section, type the desired maximum mirror rate into the Maximum mirror rate (in kilobits per second) field. If this rate is exceeded during mirroring, the excess packets are not mirrored and are counted as skipped packets. This rate applies to both local and remote mirroring. The default and minimum value is 100kbps, and the maximum is 1Gbps.
5. Select Mirror only IP packets to prevent mirroring of other Ether type packets, such as ARP or PPPoE. If selected, this option overrides any non-IP Ether types selected on the Monitor Filter view.
6. In the Local Mirror Settings section, select the destination interface for locally mirrored packets in the Mirror filtered packets to Interface (NSA platforms only) drop-down menu.

7. In the Remote Mirror Settings (Sender) section, in the Mirror filtered packets to remote SonicWall firewall (IP Address) field, type the IP address of the remote SonicWall to which mirrored packets are sent.

   The remote SonicWall network security appliance must be configured to receive the mirrored packets.

8. In the Encrypt remote mirrored packets via IPSec (preshared key-IKE) field, type the preshared key to be used to encrypt traffic when sending mirrored packets to the remote SonicWall network security appliance. Configuring this field enables an IPSec transport mode tunnel between this appliance and the remote SonicWall network security appliance. This pre-shared key is used by IKE to negotiate the IPSec keys.

9. In the Remote Mirror Settings (Receiver) section, in the Receive mirrored packets from remote SonicWall firewall (IP Address) field, type the IP address of the remote SonicWall network security appliance from which mirrored packets are received.

   The remote SonicWall network security appliance must be configured to send the mirrored packets.

10. In the Decrypt remote mirrored packets via IPSec (preshared key-IKE) field, type the pre-shared key to be used to decrypt traffic when receiving mirrored packets from the remote SonicWall network security appliance. Configuring this field enables an IPSec transport mode tunnel between this appliance and the remote SonicWall network security appliance. This pre-shared key is used by IKE to negotiate the IPSec keys.
11. Select the interface from the Send received remote mirrored packets to Interface (NSA platforms only) drop-down menu to mirror received packets to another interface on the local SonicWall network security appliance.
12. Select Send received remote mirrored packets to capture buffer to save received packets in the local capture buffer. This option is independent of sending received packets to another interface, and both can be enabled.
13. To save your settings and exit the configuration window, click Save.