FMCv Version 7.0 Snort3 drops third party inbound emails

[ranga2002]

Hi Team,

I'd like to know if anyone of you have encountered an issue where Snort3 drop inbound emails from non-domains.(Ex: Gmail, icloud,Outlook.com)

We've upgraded FMCv from 6.6.4 > 6.6.5-81 > 7.0.1-84 and then enabled Snort3. Once it enabled, inbound email traffic was dropped from above domains. In order to resolve this we've downgraded Snort to version 2. Do you have any tips to whitelist these domains and proceed to upgrade Snort 3 ?

Thank you.

[Marvin Rhoads]

I have at least half a dozen customers running Snort 3 and none have reported this issue.

Were your Intrusion Policy rules customized prior to upgrading?

[ranga2002]

Hi Marvin,

No. Is it required to manually migrate/convert rules from Snort 2 to Snort 3?