The deployment guide listed below has been updated based on feedback. The changes made were to:
- Ensuring the virtual network interrfaces (VNIs) are installed and configured before enabling Snort.
- Moving Snort to be on the LAN side of RiOS in the packet flow. This ensures that Snort only gets unoptimized traffic, as optimized traffic will not match with any of the rules.
Sorry for the late reply. I didn't test performance unfortuanately. There will be a performance hit from running an IPS/IDS of course. It'll depend on the rule set used and the traffic patterns. Have you had a chance to try out the package?
With the amount of threats facing our networks growing on a daily basis, an intrusion detection and prevention system (IDS/IPS) is an essential. An IDS/IPS system will scan all network trafficlooking for potential threats based on signatures in the traffic. Snort is the defacto open source IDS/IPS system with over a million downloads and 300,000 registered users. Able to run on RSP, Snort can be added to your network infrastructure without increasing your hardware footprint. A pre-built RSP package is available along with an easy-to-follow deployment guide, making the deployment as simple as it is essential. Links to both are below.
