Override settings in the global Snort configuration for individual NGFW Engines

You can optionally import a Snort configuration .zip file for an individual NGFW Engine to override settings in the global Snort configuration for specific NGFW Engines.

All NGFW Engines for which Snort inspection is enabled use the global Snort configuration by default. If you do not want to override settings in the global Snort configuration, it is not necessary to import a Snort configuration file for an individual NGFW Engine.

Settings in the Snort configuration .zip file for an individual NGFW Engine are combined with the settings in the global Snort configuration .zip file. If any configuration files in a Snort configuration .zip file for an individual NGFW Engine have the same files name and paths as configuration files in the global Snort configuration .zip file, the overlapping files in the global Snort configuration .zip file are ignored.
Note: NGFW Engines do not receive automatic updates for Snort rule sets. When new Snort rule sets are available, you must import new Snort configuration files and refresh the policy on the NGFW Engine to start using the new Snort rule sets.

For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Right-click an NGFW Engine, then select Edit <element type>.
  2. Browse to Add-Ons > Snort.
  3. Click Browse next to the Snort Configuration field, then select the Snort configuration file.
  4. Click Save and Refresh.

Next steps

Create Access rules to select traffic for Snort inspection.

Engine Editor > Add-Ons > Snort

Use this branch to override settings in the global Snort configuration for specific NGFW Engines.

Note: These settings are not supported for Master NGFW Engines or Virtual NGFW Engines.
Option Definition
Enable When selected, enables Snort inspection for the NGFW Engine.
Note: To apply Snort inspection to traffic, you must also create Access rules to select traffic for Snort inspection.
Snort Configuration

(Optional)

 The externally created Snort configuration .zip file that contains the Snort configuration files and rules for Snort inspection.
  • Click Browse to select a file.
  • Click None to remove a previously imported file.
  • Click Export to export the Snort configuration file.

All NGFW Engines for which Snort inspection is enabled use the global Snort configuration by default. If you do not want to override settings in the global Snort configuration, it is not necessary to import a Snort configuration file for an individual NGFW Engine.

Settings in the Snort configuration .zip file for an individual NGFW Engine are combined with the settings in the global Snort configuration .zip file. If any configuration files in a Snort configuration .zip file for an individual NGFW Engine have the same files name and paths as configuration files in the global Snort configuration .zip file, the overlapping files in the global Snort configuration .zip file are ignored.