Custom Snort 3 Intrusion Policies for Access Control

PDF

Custom Snort 3 Intrusion Policies for Access Control

Inspection of packets that pass before traffic is identified

Updated: February 4, 2026

Want to summarize with AI?

Log in

Describes the inspection process for packets that pass before the system can identify traffic and determine which access control rule applies.

Inspection of packets that pass before traffic is identified is a network security process that

  • allows a few packets to pass initially for connection establishment and traffic identification,

  • enables features like URL filtering, application detection, rate limiting, and Intelligent Application Bypass to function properly, and

  • requires explicit configuration in access control policies to inspect, prevent, and generate events for these initial packets.

Configuration requirements

You must explicitly configure your access control policy to inspect these packets, prevent them from reaching their destination, and generate any events.

As soon as the system identifies the access control rule or default action that should handle the connection, the remaining packets in the connection are handled and inspected accordingly.

Best practices for handling packets that pass before traffic identification

The default action specified for an access control policy is NOT applied to these packets.

Use these guidelines to choose a value for the Intrusion Policy used before Access Control rule is determined setting in the Advanced settings of the access control policy.

  • You can choose a system-created or custom intrusion policy. For example, you can choose Balanced Security and Connectivity.

  • For performance reasons, unless you have good reason to do otherwise, this setting should match the default action set for your access control policy.

  • If your system does NOT perform intrusion inspection (for example, in a discovery-only deployment), select No Rules Active. The system will NOT inspect these initial packets, and they will be allowed to pass.

  • By default, this setting uses the default variable set. Ensure that this is suitable for your purposes. For information, see Variable sets.

  • The network analysis policy associated with the first matching network analysis rule preprocesses traffic for the policy you select. If there are no network analysis rules, or none match, the default network analysis policy is used.

Specify a policy to handle packets that pass before traffic identification

This task explains how to specify the system's behavior for network traffic during the period before traffic identification is complete.

Note

This setting is sometimes referred to as the default intrusion policy. (This is distinct from the default action for an access control policy.)

Caution

Changing the total number of intrusion policies used by an access control policy restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the assigned device handles traffic. You can add an intrusion policy that is not currently used or remove the last instance of an intrusion policy. Intrusion policies are used in access control rules, as the default action, or as the default intrusion policy.

Before you begin

Review best practices for these settings. See Best practices for handling packets that pass before traffic identification.

Follow these steps to specify a policy to handle packets that pass before traffic identification:

Procedure

1.

In the access control policy editor, click Advanced, then click Edit (edit icon) next to the Network Analysis and Intrusion Policies section.

If View (View button) appears instead, settings are inherited from an ancestor policy, or you do not have permission to modify the settings. If the configuration is unlocked, uncheck Inherit from base policy to enable editing.

2.

Select an intrusion policy from the Intrusion Policy used before Access Control rule is determined drop-down list.

If you choose a user-created policy, you can click Edit (edit icon) to edit the policy in a new window. You cannot edit system-provided policies.
3.

Optionally, select a different variable set from the Intrusion Policy Variable Set drop-down list. You can also select Edit (edit icon) next to the variable set to create and edit variable sets. If you do not change the variable set, the system uses a default set.
4.

Click OK.
5.

Click Save to save the policy.

What to do next

  • Deploy configuration changes.

Related topics