Run pfsense infront of another router for only the snort capability
-
I wanted to know if it's possible to put pfsense infront of another router only for the snort functionality. I would want to put pfsense in a "transparent mode" or make it so it allows all traffic both ways. Not act as a packet filter. What I am trying to get at is I need to keep my ASAs in place, but I want an easy to use snort or some type of IPS/IDS infront of them. I like the snort gui in pfsense and it's easy to use for me. Any ideas on how this would work or other IDS/IPS products that are easy to use with a gui? I assume I would want to use bypass nics? Any help is appreciated. Thanks.
-
You can a bridge between 2 interfaces and Snort will see this as seperate interfaces and act as it is in "transparant mode". I did use this once to implement it quickly without the hassle of routing changes and other inconveniences.
I use routed interfaces in production.
-
So you went away from this. How did you configure the bridge? Any details? This is new to me. Thanks.