Question

A security team wants to mirror traffic from a specific group of production web servers to a self-managed intrusion detection appliance for deep packet inspection. The web servers all share the network tag 'web-frontend'. The team wants to avoid mirroring traffic from all other VMs in the same subnet to control the volume of mirrored data and analysis costs. When configuring the Packet Mirroring policy, how should they specify which instances are mirrored?

Accepted Answer

Set the mirrored source using the network tag 'web-frontend' in the Packet Mirroring policy so only tagged instances are mirrored

Answer

Mirror the entire subnet containing the web servers, then apply a firewall rule referencing the 'web-frontend' tag to exclude other VMs

Answer

Configure the collector destination as an instance group filtered by the 'web-frontend' tag

Answer

Attach a service account to the web servers and specify that service account as the mirrored source in the policy