Some enterprise network gear even has CALEA modules built in to facilitate traffic intercepts. For example, here's some docs from both Mikrotik and Cisco:
https://wiki.mikrotik.com/wiki/CALEA
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6...