Re: Port mirroring VMC for Security Product

petemb · ‎01-21-2021

Hi All

We are looking to deploy a security platform on VMC that utilises a dedicated per-host appliance. on vSphere (on-prem), ports were mirrored by way of creating a dedicated vDS portgroup for the hosts.

I see from various articles online that we can create a port mirroring session for each segment (see https://cloud.vmware.com/community/2019/04/25/port-mirroring-vmware-cloud-aws/) that could forward to a security endpoint appliance, but how can we achieve the same as we have on prem, in VMC and capture traffic in the same way as on prem?

Cheers

PMB

Pablo_Cruces_ · ‎01-21-2021

Hi @petemb,

You can use port mirroring in VMConAWS to analyze Ingress, Egress or Bi Directional traffic.

Port Mirroring use a "source group" where the data is monitored and a "destination group" where the data is copied to, so you will need to create Compute Groups for the source VMs and the destination VMs to send the traffic ( this destination group is based on IPs addresses)

Also you you will need a virtual appliance to be deployed on the VMConAWS side as your security VM to analyze the traffic or install the security software in a new VM.

The steps are quite simple:

Login in to the VMC console and select Networking & Security and then Port Mirroring
On the Port Mirroring tab Add Profile and create a new one. Select here the parameters you would line to monitor:
Tag the port mirroring profile to use it for future needs if you want, so when you create new VMs or the ones you have, you can add this tag and all of them will be under the same security profile you just created.