Home
Support
Product Support
Security
Cisco Secure Firewall Management Center
Configuration Guides

Custom Snort 3 Intrusion Policies for Access Control

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Custom Snort 3 Intrusion Policies for Access Control

Expand all sections

About this content

Intrusion Prevention Overview

Intrusion prevention
Snort inspection engine
Snort 3
Multi-layer inspection
Guidelines and limitations for network analysis and intrusion policies
Prerequisites for network analysis and intrusion policies
How policies examine traffic for intrusions
System-provided and custom network analysis and intrusion policies

Migrate from Snort 2 to Snort 3

Snort 3 inspection engine
Snort 2 versus Snort 3
Migrating from Snort 2 to Snort 3
View Snort 2 and Snort 3 base policy mapping
Synchronize Snort 2 rules with Snort 3
Deploy configuration changes
Examples for migration

Intrusion Policies

Intrusion policies
Create a custom snort 3 intrusion policy
Edit Snort 3 Intrusion Policies
Change the base policy of an intrusion policy
View Snort 2 and Snort 3 base policy mapping
Synchronize Snort 2 rules with Snort 3
Manage intrusion policies
Access control rule configuration to perform intrusion prevention
Tune Intrusion Policies using Rules
Recommended rules
Mitigate threats using MITRE framework in Snort 3 intrusion policies

Intrusion Prevention Performance Tuning

Intrusion prevention performance tuning
License requirements for intrusion prevention performance tuning
Requirements and prerequisites for intrusion prevention performance tuning
Limiting pattern matching for intrusions
Regular expression limits overrides for intrusion rules
Override regular expression limits for intrusion rules
Per packet intrusion event generation limits
Limiting intrusion events generated per packet
Packet and intrusion rule latency threshold configuration
Intrusion performance statistic logging configuration
Configure intrusion performance statistic logging

Network Analysis Policies

Network analysis policies
Manage network analysis policies
Snort 3 definitions and terminologies for network analysis policies
Custom network analysis policy creation for Snort 3
Network analysis policy settings and cached changes
Generate Snort 3 recommendations

Advanced Access Control settings for Network Analysis and Intrusion Policies

Advanced access control settings for network analysis and intrusion policies
Advanced access control settings for network analysis and intrusion policies
Requirements and prerequisites for advanced access control settings for network analysis and intrusion policies
Inspection of packets that pass before traffic is identified
Advanced settings for network analysis policies

Custom Snort 3 Intrusion Policies for Access Control

Limiting intrusion events generated per packet

Updated: February 4, 2026

Want to summarize with AI?

Configure the intrusion event logging limits to control the number of intrusion events generated per packet.

This task allows you to control the number of intrusion events generated per packet by configuring intrusion event logging limits in the access control policy performance settings.

Use this task when you need to manage intrusion detection system performance by limiting the number of events generated for each packet processed by the firewall.

Procedure

	1.	In the access control policy editor, click Advanced. In the new UI, select Advanced Settings from the drop-down arrow at the end of the packet flow line.
	2.	Click Edit () next to Performance Settings. If View () appears instead, settings are inherited from an ancestor policy, or you do not have permission to modify the settings. If the configuration is unlocked, uncheck Inherit from base policy to enable editing.
	3.	Click Intrusion Event Logging Limits in the Performance Settings pop-up window.
	4.	You can modify any of the options in Per packet intrusion event generation limits.
	5.	Click OK.
	6.	Click Save to save the policy.

What to do next

Deploy configuration changes.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.