SNORT Process Restart

[fatalXerror]

Hi, I want to restart my SNORT process, will it drop traffic? Is there any way to restart SNORT without any dropping of traffic? Thanks

[Marvin Rhoads]

A snort restart will typically interrupt active flows.

Here's how to do it from the sensor cli (FTD running on a Firepower appliance in this case):

> expert
admin@fw1:~$ sudo su    
Password: 
root@fw1:/home/admin# pmtool restartbytype snort ?
root@fw1:/home/admin# pmtool | grep snort  

[fatalXerror]

thanks @Marvin Rhoads, is there any other ways to do it without any interruption?

[Marvin Rhoads]

There is an option available as of Firepower 6.2.0.2 and 6.2.3 that changed the previous default behavior.

configure snort preserve-connection enable

• When Snort goes down connections with Allow verdict are preserved in LINA
• Snort does NOT do a mid-session pickup on preserved flows when starting up
• Does NOT protect against new flows while Snort is down

https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/c_3.html#wp1594004510