Hey everyone! 👋 I’ve been trying to set up a decrypted traffic mirror from our FortiSASE to our internal IDS for deeper inspection. I’m fairly new to FortiSASE, but I’ve worked with APIs and Python for other integrations. I *think* I’ve got the basic flow working, but I’d love a sanity check and to hear how others have tackled this.
Here’s what I’ve done so far:
* Enabled SSL inspection in the FortiSASE web policy (used a “Certificate Inspection” profile I created).
* Configured a traffic mirroring policy to forward matching decrypted traffic to our IDS sensor IP on a specific port.
* Set up a span port on our internal switch to receive the mirrored traffic for the IDS.
My main questions:
1. **Decryption Point:** Is the traffic decrypted *before* it’s mirrored from the FortiSASE PoP? I want to make sure our IDS is analyzing the unencrypted stream.
2. **Configuration Snippet:** Here’s a bit of the CLI-style config I used for the mirroring policy (via the API). Does this look right?
```json
{
"name": "Mirror-to-IDS",
"action": "accept",
"service": ["ALL"],
"srcintf": ["virtual-wan-link"],
"dstintf": ["internal"],
"srcaddr": ["all"],
"dstaddr": ["all"],
"traffic-mirror": "enable",
"traffic-mirror-interface": "port1",
"traffic-mirror-destination": "10.10.50.100"
}
```
3. **Performance Impact:** Has anyone noticed a significant hit on throughput or latency when enabling this? We’re still in a testing phase.
Also, if anyone has automated pulling mirroring session logs via the FortiSASE API for correlation, I’d be super curious to see examples. My Python script is still a work in progress!
Hey user44, welcome to the fun world of traffic mirroring! 🦉
> Is the traffic decrypted *before* it's mirrored
Yes, it should be. The mirroring action typically happens after the SSL inspection profile does its work in the policy flow. So your IDS should be seeing the plaintext stream. That's the whole point!
Your config snippet looks right for the policy part, but you cut off the `dstaddr` array 😉. The main thing I'd check is that your `"action": "accept"` also has the mirroring flag set (sometimes it's a separate `set traffic-mirror enable` in the CLI or a checkbox in the GUI). Without that, traffic just flows but isn't mirrored.
One gotcha from my setup: make sure your IDS sensor's interface is in promiscuous mode and the switch span/mirror port config is correct. I've spent hours debugging only to find the span session was filtering out the VLAN tags I needed. Good luck!
See the signal