Home
Support
Product Support
Security
Cisco Secure Firewall Management Center
Configuration Guides

Custom Snort 3 Intrusion Policies for Access Control

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Custom Snort 3 Intrusion Policies for Access Control

Expand all sections

About this content

Intrusion Prevention Overview

Intrusion prevention
Snort inspection engine
Snort 3
Multi-layer inspection
Guidelines and limitations for network analysis and intrusion policies
Prerequisites for network analysis and intrusion policies
How policies examine traffic for intrusions
System-provided and custom network analysis and intrusion policies

Migrate from Snort 2 to Snort 3

Snort 3 inspection engine
Snort 2 versus Snort 3
Migrating from Snort 2 to Snort 3
View Snort 2 and Snort 3 base policy mapping
Synchronize Snort 2 rules with Snort 3
Deploy configuration changes
Examples for migration

Intrusion Policies

Intrusion policies
Create a custom snort 3 intrusion policy
Edit Snort 3 Intrusion Policies
Change the base policy of an intrusion policy
View Snort 2 and Snort 3 base policy mapping
Synchronize Snort 2 rules with Snort 3
Manage intrusion policies
Access control rule configuration to perform intrusion prevention
Tune Intrusion Policies using Rules
Recommended rules
Mitigate threats using MITRE framework in Snort 3 intrusion policies

Intrusion Prevention Performance Tuning

Intrusion prevention performance tuning
License requirements for intrusion prevention performance tuning
Requirements and prerequisites for intrusion prevention performance tuning
Limiting pattern matching for intrusions
Regular expression limits overrides for intrusion rules
Override regular expression limits for intrusion rules
Per packet intrusion event generation limits
Limiting intrusion events generated per packet
Packet and intrusion rule latency threshold configuration
Intrusion performance statistic logging configuration
Configure intrusion performance statistic logging

Network Analysis Policies

Network analysis policies
Manage network analysis policies
Snort 3 definitions and terminologies for network analysis policies
Custom network analysis policy creation for Snort 3
Network analysis policy settings and cached changes
Generate Snort 3 recommendations

Advanced Access Control settings for Network Analysis and Intrusion Policies

Advanced access control settings for network analysis and intrusion policies
Advanced access control settings for network analysis and intrusion policies
Requirements and prerequisites for advanced access control settings for network analysis and intrusion policies
Inspection of packets that pass before traffic is identified
Advanced settings for network analysis policies

Custom Snort 3 Intrusion Policies for Access Control

Change the base policy of an intrusion policy

Updated: February 4, 2026

Want to summarize with AI?

Configure a different system-provided or custom policy as the base policy for an intrusion policy.

Change the base policy to use a different system-provided or custom policy as the foundation for your intrusion policy configuration.

You can choose a different system-provided or custom policy as your base policy. You can chain up to five custom policies, with four of the five using one of the other four previously created policies as its base policy; the fifth must use a system-provided policy as its base.

Procedure

	1.	Choose Policies > Access Control heading > Intrusion.
	2.	Click Edit () next to the intrusion policy you want to configure.
	3.	Choose a policy from the Base Policy drop-down list.
	4.	Click Save.

What to do next

Deploy configuration changes. See Deploy configuration changes.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.