Custom Snort 3 Intrusion Policies for Access Control

PDF

Custom Snort 3 Intrusion Policies for Access Control

Advanced settings for network analysis policies

Updated: February 4, 2026

Want to summarize with AI?

Log in

Describes advanced configuration options for network analysis policies that enable customized traffic preprocessing through multiple policies and network analysis rules.

A network analysis policy is a traffic preprocessing configuration that governs how traffic is decoded and preprocessed so that it can be further evaluated, especially for anomalous traffic that might signal an intrusion attempt.

Advanced configuration concepts

This traffic preprocessing occurs after Security Intelligence matching and traffic decryption, but before intrusion policies inspect packets in detail. By default, the system-provided Balanced Security and Connectivity network analysis policy is the default network analysis policy.

Tip

The system-provided Balanced Security and Connectivity network analysis policy and the Balanced Security and Connectivity intrusion policy work together and can both be updated in intrusion rule updates. However, the network analysis policy governs mostly preprocessing options, whereas the intrusion policy governs mostly intrusion rules.

A simple way to tune preprocessing is to create and use a custom network analysis policy as the default. If you are an advanced user with a complex deployment, you can create multiple network analysis policies, each tailored to preprocess traffic differently. Then, you can configure the system to use those policies to govern the preprocessing of traffic using different security zones, networks, or VLANs.

To accomplish this, you add custom network analysis rules to your access control policy. A network analysis rule is simply a set of configurations and conditions that specifies how you preprocess traffic that matches those qualifications. You create and edit network analysis rules in the advanced options in an existing access control policy. Each rule belongs to only one policy.

Each rule has:

  • a set of rule conditions that identifies the specific traffic you want to preprocess

  • an associated network analysis policy that you want to use to preprocess traffic that meets all the rules' conditions

When it is time for the system to preprocess traffic, it matches packets to network analysis rules in top-down order by rule number. Traffic that does not match any network analysis rules is preprocessed by the default network analysis policy.

Set the default network analysis policy

Setting a default network analysis policy establishes the baseline preprocessing behavior for network traffic analysis within your access control policy.

You can choose a system- or user-created policy.

Note

If you disable a preprocessor but the system needs to evaluate preprocessed packets against an enabled intrusion or preprocessor rule, the system automatically enables and uses the preprocessor although it remains disabled in the network analysis policy web interface. Tailoring preprocessing, especially using multiple custom network analysis policies, is an advanced task. Because preprocessing and intrusion inspection are so closely related, you must be careful that you allow the network analysis and intrusion policies examining a single packet to complement each other.

Procedure

1.

In the access control policy editor, click Advanced, then click Edit (edit icon) next to the Network Analysis and Intrusion Policies section.

If View (View button) appears instead, settings are inherited from an ancestor policy, or you do not have permission to modify the settings. If the configuration is unlocked, uncheck Inherit from base policy to enable editing.

2.

From the Default Network Analysis Policy drop-down list, select a default network analysis policy.

If you choose a user-created policy, you can click Edit (edit icon) to edit the policy in a new window. You cannot edit system-provided policies.

Caution

Changing the total number of network analysis policies used by an access control policy restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the assigned device handles traffic. You change the total number of network analysis policies by adding a policy that is not currently used, or by removing the last instance of a network analysis policy. You can use a network analysis policy with network analysis rules or as the default network analysis policy.
3.

Click OK.
4.

Click Save to save the policy.

What to do next

  • Deploy configuration changes.

Network analysis rules

A network analysis rule is a preprocessing configuration component that

  • tailors preprocessing configurations to network traffic within access control policy advanced settings,

  • matches packets in top-down order by ascending rule number, starting at 1, and

  • preprocesses traffic according to the first rule where all conditions match.

Network analysis rule conditions and matching

You can add zone, network, and VLAN tag conditions to a rule. If you do not configure a particular condition for a rule, the system does not match traffic based on that criterion. For example, a rule with a network condition but no zone condition evaluates traffic based on its source or destination IP address, regardless of its ingress or egress interface. Traffic that does not match any network analysis rules is preprocessed by the default network analysis policy.

Network analysis policy rule conditions

Network analysis policy rule conditions are configuration parameters that enable you to fine-tune your network analysis policy to target the users and networks you want to control.

Security zone rule conditions

A security zone rule condition is a network traffic control mechanism that

  • segments your network to help you manage, classify, and decrypt traffic flow by grouping interfaces across multiple devices,

  • controls or decrypts traffic by its source and destination security zones, and

  • requires all interfaces in a zone to be of the same type (all inline, passive, switched, or routed).

Zone condition traffic matching

If you add both source and destination zones to a zone condition, matching traffic must originate from an interface in one of the source zones and leave through an interface in one of the destination zones.

All zones used in a zone condition must be of the same type. Because devices deployed passively do not transmit traffic, you cannot use a zone with passive interfaces as a destination zone.

Minimize the number of matching criteria whenever possible, especially those for security zones, network objects, and port objects. When you specify multiple criteria, the system must match against every combination of the contents of the criteria you specify.

Tip

Constraining rules by zone is one of the best ways to improve system performance. If a rule does not apply to traffic through any of device's interfaces, that rule does not affect that device's performance.

Security zone conditions in multidomain environments

In a multidomain deployment, a zone created in an ancestor domain can contain interfaces that reside on devices in different domains. When you configure a zone condition in an descendant domain, your configurations apply to only the interfaces you can see.

Network rule conditions

A network condition is a traffic matching criterion that

  • controls or decrypts traffic based on source and destination IP addresses using inner packet headers,

  • enables administrators to specify exact IP addresses or blocks for granular policy enforcement, and

  • can be built using predefined network objects or by manually entering IP addresses or address blocks.

Network rule condition restrictions

Minimize the number of matching criteria whenever possible, especially those for security zones, network objects, and port objects. When you specify multiple criteria, the system must match against every combination of the contents of the criteria you specify.

Note

You cannot use FDQN network objects in identity rules.

VLAN tag rule conditions

VLAN tags rule conditions are filtering mechanisms that

  • control VLAN-tagged traffic, including Q-in-Q (stacked VLAN) traffic

  • use the innermost VLAN tag to filter VLAN traffic, with the exception of prefilter policy which uses the outermost VLAN tag, and

  • apply only to inline sets and do not match traffic on firewall interfaces.

VLAN tag rule conditions configuration details

Note

VLAN tags in access rules only apply to inline sets. Access rules with VLAN tags do not match traffic on firewall interfaces.

The system uses the innermost VLAN tag to filter VLAN traffic, with the exception of the prefilter policy, which uses the outermost VLAN tag in its rules.

Note this Q-in-Q support:

  • Firewall Threat Defense on Firepower 4100/9300—Does not support Q-in-Q (supports only one VLAN tag).

  • Firewall Threat Defense on all other models:

    • Inline sets and passive interfaces—Supports Q-in-Q, up to 2 VLAN tags.

    • Firewall interfaces—Does not support Q-in-Q (supports only one VLAN tag).

You can use predefined objects to build VLAN conditions, or manually enter any VLAN tag from 1 to 4094. Use a hyphen to specify a range of VLAN tags.

In a cluster, if you encounter problems with VLAN matching, edit the access control policy advanced options, Transport/Network Preprocessor Settings, and select the Ignore the VLAN header when tracking connections option.

Configure network analysis rules

Network analysis rules allow you to specify which network analysis policy should preprocess traffic that matches specific conditions, providing granular control over traffic inspection before intrusion detection.

Network analysis rules are configured within the advanced settings of an access control policy. You can create custom rules to apply different network analysis policies based on traffic conditions such as source, destination, ports, or applications.

Before you begin

Follow these steps to configure network analysis rules:

Procedure

1.

In the access control policy editor, click Advanced, then click Edit (edit icon) next to the Network Analysis and Intrusion Policies section.

If View (View button) appears instead, settings are inherited from an ancestor policy, or you do not have permission to modify the settings.If the configuration is unlocked, uncheck Inherit from base policy to enable editing.

Tip

Click Network Analysis Policy List to view and edit existing custom network analysis policies.
2.

Next to Network Analysis Rules, click the statement that indicates how many custom rules you have.
3.

Click Add Rule.
4.

Configure the rule's conditions by clicking the conditions you want to add.
5.

Click Network Analysis and choose the Network Analysis Policy you want to use to preprocess the traffic matching this rule.

Click Edit (edit icon) to edit a custom policy in a new window. You cannot edit system-provided policies.

Caution

Changing the total number of network analysis policies used by an access control policy restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the assigned device handles traffic.You change the total number of network analysis policies by adding a policy that is not currently used, or by removing the last instance of a network analysis policy. You can use a network analysis policy with network analysis rules or as the default network analysis policy.
6.

Click Add.

What to do next

  • Deploy configuration changes.

Manage network analysis rules

Network analysis rules allow you to control how traffic preprocessing occurs by defining specific conditions and configurations that determine traffic handling methods.

A network analysis rule is simply a set of configurations and conditions that specifies how you preprocess traffic that matches those qualifications. You create and edit network analysis rules in the advanced options in an existing access control policy. Each rule belongs to only one policy.

Procedure

1.

In the access control policy editor, click Advanced, then click Edit (edit icon) next to the Intrusion and Network Analysis Policies section.

If View (View button) appears instead, settings are inherited from an ancestor policy, or you do not have permission to modify the settings.If the configuration is unlocked, uncheck Inherit from base policy to enable editing.
2.

Next to Network Analysis Rules, click the statement that indicates how many custom rules you have.
3.

Edit your custom rules. You have the following options:

  • To edit a rule's conditions, or change the network analysis policy invoked by the rule, click Edit (edit icon) next to the rule.

  • To change a rule's order of evaluation, click and drag the rule to the correct location. To select multiple rules, use the Shift and Ctrl keys.

  • To delete a rule, click Delete (delete icon) next to the rule.

Tip

Right-click a rule to display a context menu that lets you cut, copy, paste, edit, delete, or add new network analysis rules.
4.

Click OK.
5.

Click Save to save the policy.

What to do next

  • Deploy configuration changes.

Related topics