Question

A security team at a financial services company needs to inspect east-west traffic between production application VMs using a third-party intrusion detection system (IDS). The IDS runs on a fleet of self-managed VM appliances that must scale horizontally. Traffic from mirrored production instances must be delivered to these appliances without dropping packets during appliance autoscaling events, and the collector must be reachable from the mirrored sources within the same region. How should the security team configure the Packet Mirroring collector destination?

Accepted Answer

Configure the Packet Mirroring policy to send mirrored traffic to an internal passthrough Network Load Balancer that fronts the managed instance group of IDS appliances, with the forwarding rule marked for Packet Mirroring.

Answer

Configure the Packet Mirroring policy to send mirrored traffic directly to the primary internal IP of each IDS appliance VM listed as individual collector targets.

Answer

Configure the Packet Mirroring policy to send mirrored traffic to an external passthrough Network Load Balancer so the IDS appliances can also receive traffic from other regions.

Answer

Configure the Packet Mirroring policy to send mirrored traffic to an internal Application Load Balancer (Layer 7) fronting the IDS appliance instance group.