Enabling TAP-mode on an appliance is extremely straightforward. There are two additional commands needed:
set tap dest-ports <port list> set tap enable true
The first command identifies the traffic of interest, by port number. The default value of 443 for HTTPS is the most common setting, but a comma separated list of ports can be used.
The second command actually enables the reception of traffic from a decrypting TAP, like Blue Coat’s E-TAP or Palo Alto Network’s Decryption Port Mirror functions, on the dedicated TAP port.
These commands can be added to either a management plane (MP) appliance or a log parsing (LP) appliance, depending on the traffic requirements. Please follow the instructions to deploy the MP and LP appliances for initial configuration, and don’t forget to enter the save command to activate the new settings.