https://community.cisco.com/t5/network-security/firepower-prefilter-tunneled-traffic/m-p/4898992#M1103255 <P>AFAIK, it's just one level down as you surmised.</P> Fri, 04 Aug 2023 19:45:10 GMT Marvin Rhoads 2023-08-04T19:45:10Z https://community.cisco.com/t5/network-security/firepower-prefilter-tunneled-traffic/m-p/4898956#M1103251 <P>I was asked the following question.&nbsp; I think I know the answer, but would like to validate it.</P> <P>=======</P> <P>Question: How many levels down of traffic tagged as tunneled by the prefilter can the Snort Engine analyze?</P> <P>=======</P> <P>If traffic is identified as 'Tunneled' in the prefilter, LINA will tag that traffic for the Snort Engine to take a deeper look: to analyze let's say not only the GRE session, but also the tunneled session.&nbsp;</P> <P>What about if the traffic is BGP over GRE over GRE?&nbsp; &nbsp;[Why would you want to do this?&nbsp; I don't have a practical example, but regardless, the question is valid].&nbsp;&nbsp;</P> <P>I suspect that the Snort engine seeing only 1 tunneled tag with only look at one level down.&nbsp; But I would like to get a confirmation on this.&nbsp;</P> <P>Thanks.</P> Fri, 04 Aug 2023 18:06:55 GMT https://community.cisco.com/t5/network-security/firepower-prefilter-tunneled-traffic/m-p/4898956#M1103251 cpaquet 2023-08-04T18:06:55Z https://community.cisco.com/t5/network-security/firepower-prefilter-tunneled-traffic/m-p/4898992#M1103255 <P>AFAIK, it's just one level down as you surmised.</P> Fri, 04 Aug 2023 19:45:10 GMT https://community.cisco.com/t5/network-security/firepower-prefilter-tunneled-traffic/m-p/4898992#M1103255 Marvin Rhoads 2023-08-04T19:45:10Z