New Router. Backup Restored. No Snort Alerts now
-
Hi,
I upgraded my router from a J1900 router to an N100. After installing pfSense CE 2.7.2, I restored a current backup and Snort failed to install. So I manually installed Snort and verified that all the Interfaces were correctly configured as before, active and enabled, and that all the updates to the Rule Sets where current (it appears to have saved the configuration from the backup and applied it once Snort was manually installed).
But Snort has not reported any alerts since the upgrade from 3 weeks ago, whereas before it would report a few alerts every day.
Suggestions on where to look for clues on what's going wrong?
Thanks
-
Did your network interface names change by chance? For instance, if your new hardware contains different NIC hardware than your old hardware, then the physical interface names will have changed and that can confuse Snort (especially if it was restored from a configuration based on the old physical interface names).
If you hardware NICs changed, I suggest deleting all the Snort interfaces and then creating them again.
-
@bmeeks :
Ok. So I disabled and unassigned the WAN Sort interface. Then copied it back to the newly unused WAN interface, enabled and started it and...... IT WORKED!!! I'm getting Alerts and its generating blocks as before the upgrade!Same name as before, but apparently an internal interface mapping in Snort was still looking for the old WAN interface id.
Thanks!!!
