The Mirror interface is used to capture and analyze network traffic without interrupting or altering the flow of data. It typically acts as a "passive" interface that copies traffic from a monitored source for inspection, making it ideal for traffic analysis, monitoring, or intrusion detection.

The Virtual Wire interface is a more active, transparent mode of operation where the firewall acts as a bridge between two network segments, without altering the IP addressing or routing. It allows traffic to flow between interfaces as if the firewall were invisible to the network, providing security features like filtering and inspection without requiring changes to the network topology or IP configuration. Both interfaces help to enhance visibility and security in different deployment scenarios.

HiHi,

Mirror Interface is generally used for devices to monitor the intranet with bypass deployment. Select the network segment to be monitored under Network Objects. At the same time, you need to enable mirroring on the connected switch and mirror traffic to the NGAF device mirroring interface.

Virtual wire interface is also a common switching interface. It does not need to be configured with an IP address and does not support routing. For data forwarding, the device will not check the MAC table but directly forward it from the interface paired with the virtual network cable. Different from the bridge interface, the virtual wire interfaces appear in pairs.

Please find the link below for details:

https://knowledgebase.sangfor.com/detailPage?articleData=%7B%22articleType%22%3A1,%22articleId%22%3A%22a614340730564e7f9b1928df5da010a7%22,%22keyword%22%3A%22%22%7D