topic Re: configure snort preserve-connection disable at FirePower 8370 in Network Security

configure snort preserve-connection disable at FirePower 8370

subrun.jamil — Wed, 19 Jun 2019 20:37:52 GMT

Hello All,

I was checking to see if below command I can configure at FirePower 8370 Stack. But once I login to one of the 8370 stack member ( 8350 ) , i am not able to find this command available. Also how can I see this preserve-connection is enabled or not ?

configure snort preserve-connection disable

Re: configure snort preserve-connection disable at FirePower 8370

Marvin Rhoads — Thu, 20 Jun 2019 04:07:01 GMT

That's an FTD 6.2.0.2 or later command. I don't believe it applies for classic Firepower devices such as the 8300 series.

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/policy_management.html?bookSearch=true#concept_33516C5D6B574B6888B1A05F956ABDF9

Re: configure snort preserve-connection disable at FirePower 8370

subrun.jamil — Tue, 02 Jul 2019 16:02:13 GMT

Thank You Marvin, is this option available at FirePower 9300 Devices ?

Re: configure snort preserve-connection disable at FirePower 8370

Marvin Rhoads — Wed, 03 Jul 2019 01:09:13 GMT

@subrun.jamil Yes, as long as you are running FTD software 6.2.0.2 or later.

Since 6.2.3 that setting is the default.

Re: configure snort preserve-connection disable at FirePower 8370

Marvin Rhoads — Thu, 04 Jul 2019 03:43:43 GMT

Also note this input on LinkedIn from a Cisco employee:

https://www.linkedin.com/feed/update/urn:li:article:7881703287665014963/?commentUrn=urn%3Ali%3Acomment%3A(article%3A7881703287665014963%2C6547324070411755520)