Snort - SID Management

justme2

All,

If you enable the checkbox under "SID Management" and click save - there appears to be no way to 'revert' this behavior unless you completely delete any interface configs and start over. The "SAVE" button disappears if it's unchecked - leaving no option to remove the functionality. Is that expected or was a bug stumbled upon?

Thanks!

bmeeks

Yeah, that's not supposed to happen. I will put it on my TODO list of bugs to fix. In the meantime, here is how to disable the feature if you want to stop using it. The steps below turn off the functionality of SID MGMT.

Click the checkbox so the page info is displayed on the SID MGMT tab.
Down at the bottom of the page, make sure all of the drop-down selectors for the Enable SID List, Disable SID List and Modify SID List are set to "none".
Now click Save. If you want to immediately rebuild the rules for each configured interface, click the Rebuild checkbox beside each interface before clicking Save.

This will remove the list assignment and thus no SID MGMT settings will be used.