Snort + CARP

[UnderCover]

I checked the box in snort to sync with secondary carp members  but it does not work…  carp works on everything else its supposed to though..

any suggestions?

[hoba]

did you setup the config sync part master->slave too at firewall>virtual ips, carp settings and made sure it works and is not blocked by firewallrules or something? In that case you should get a sync error alert in the header.

[UnderCover]

yes, the master-> slave works everywhere but snort.  I get no message at the top