thanks yang for your return,
i'm agree with you, for the endpoint that's what we are finally planning to do.
for the Monitor, i'm agree that the fact to manually reconfigure for the network traffic span port changement is a necessary.
what about the Network Prevent (Web/SMTP)?