Cisco Firewall + IPS: From Stateful Inspection to Snort 3 Threat Prevention
A modern firewall is no longer simply a barrier between an internal network and the Internet. It is an enforcement point that evaluates connection state, security policy, network context, application behaviour and, where deployed, deeper threat inspection before deciding what should happen to a flow.
Cisco Secure Firewall technologies combine stateful firewalling with additional inspection and intrusion prevention capabilities. Snort provides the inspection engine used to analyse traffic for protocol behaviour, signatures and other indicators of suspicious activity. The important engineering question is not simply which security features exist, but how traffic moves through these controls and how each stage contributes evidence to the final decision.
This guide therefore follows the security decision rather than treating firewalling and IPS as isolated technologies. We will start with the stateful firewall, move into Snort-based inspection, investigate a realistic security incident, and finish by examining how security teams correlate detection, prevention and operational evidence.
Integrated Threat Prevention Architecture
Modern firewall protection combines stateful access control with deep traffic inspection, threat intelligence and inline prevention. Select a stage to see what happens to traffic as it moves through the security stack.
Internet Traffic
Traffic enters the security boundary from an external network. The firewall begins evaluating the connection before the flow can reach protected internal resources.
The Stateful Firewall: From Packet to Security Decision
A firewall decision is not simply the result of matching an IP address and port against an access-control rule. A stateful firewall evaluates traffic in context, combining packet information, security-zone context, connection state, policy, translation and additional inspection before producing an enforcement result.
This distinction matters because the packet an engineer captures at one point in the network is only part of the story. The firewall may already have a connection record for the flow, may translate the addresses before forwarding the traffic, or may apply additional inspection after the initial policy evaluation.
The first engineering task is therefore to reconstruct the decision path: what entered the firewall, how it was classified, what state existed, which policy applied, what transformations occurred and what ultimately caused the traffic to be allowed or rejected.
The firewall decision path
Why stateful inspection matters
Stateful inspection maintains information about active connections rather than evaluating every packet as an unrelated event. For TCP traffic, for example, the firewall can use connection state to determine whether a packet belongs to an established session or represents an unexpected transition.
This creates an important troubleshooting dependency. If the application reports that a connection is established but the firewall has no matching state entry, the engineer has evidence that something in the expected flow is inconsistent. Conversely, seeing an established state does not automatically prove that the application is healthy; return traffic, inspection and downstream dependencies still need to be considered.
Security zones establish context
A firewall also evaluates where traffic comes from and where it is going. External, internal, DMZ and other logical security zones provide the context in which policy decisions are interpreted.
The same destination port can therefore represent very different security decisions depending on the source zone, destination zone, interface and configured policy. An engineer investigating a failure should always establish the traffic direction before interpreting an access-control result.
Questions to establish the context
Policy is only one part of the decision
Access-control policy is often the first place engineers look when traffic fails. That is sensible, but it is not sufficient. A rule permitting HTTPS does not by itself prove that the flow will successfully traverse the security stack.
The engineer must establish which policy entry actually matched the flow, whether the intended source and destination objects were used, and whether the policy result was consistent with the configured security intent.
If the rule is correct, investigation should continue rather than stopping at the access-control layer.
NAT changes the observed flow
Network Address Translation introduces another important evidence point. The address seen by the originating host may not be the address observed by the destination. During troubleshooting, engineers therefore need to distinguish the original flow from the translated representation.
A correct security policy combined with an incorrect translation can produce a failure that initially looks like a connectivity or routing problem. Translation records therefore belong in the same investigation chain as policy and state information.
Inspection can change the decision
Once the basic firewall decision has been established, additional inspection may evaluate application behaviour, protocol characteristics or security conditions. This is where traditional stateful firewalling begins to intersect with intrusion prevention and deeper traffic analysis.
The important operational distinction is that an allowed connection is not necessarily the end of processing. Depending on the platform and configured security policy, traffic may continue through additional inspection controls before the final action is complete.
Do not begin with the assumption that the firewall blocked the traffic. Establish the observed flow, security context, state, policy match, translation and inspection result in that order. Each observation removes another possible explanation from the investigation.
What the engineer should be able to prove
By the end of this stage, the engineer should be able to explain the firewall decision using evidence rather than configuration alone.
Next, work through a live firewall flow and step through the decision pipeline. The lab will expose the changing state, policy evaluation, NAT context, inspection result and final action so the decision can be investigated rather than simply described.
Stateful Firewall Decision Engine
A stateful firewall does more than inspect individual packets. It evaluates the connection context, compares traffic against policy, performs required translation and inspection, and then determines whether the flow should continue.
Source — Packet Arrival
A packet enters the firewall interface and becomes part of the firewall's processing pipeline. The device identifies the traffic context before applying security policy.
From Packet to Security Decision
HTTPS client
Outside: 198.51.100.10
TCP/443
Cisco IPS and Snort: From Traffic to Threat Detection
Stateful firewalling answers an important question: should this traffic be permitted through the security boundary? Intrusion prevention asks a different question: does the traffic itself contain characteristics that indicate malicious, anomalous or otherwise suspicious behaviour?
This distinction is critical when investigating security events. A flow can be permitted by the access-control policy and still trigger deeper inspection. Conversely, an IPS alert does not automatically mean that the connection was blocked. The configured inspection mode and resulting action must be established from evidence.
Snort provides a useful engineering model for understanding this deeper inspection process. Traffic moves through a sequence of processing stages where packets are decoded, associated with flows, interpreted by protocol inspectors, evaluated against detection logic and finally associated with an enforcement action.
The Snort inspection pipeline
Detection is more than signature matching
Signature-based detection is an important part of intrusion prevention, but modern inspection can use several forms of evidence. Protocol characteristics, application behaviour, flow context and other security conditions can contribute to determining whether traffic should be considered suspicious.
This creates a different troubleshooting model from traditional packet filtering. Instead of asking only which rule matched an address and port, the engineer needs to understand what the inspection engine observed and which condition caused the detection.
Snort 2 and Snort 3 as engineering models
The evolution from Snort 2 to Snort 3 is useful for understanding how modern inspection engines organise processing. The older architecture provides a useful model of packet decoding, preprocessing, detection and output. Snort 3 expands this approach with a more modular architecture and greater emphasis on protocol inspectors and parallel processing.
A useful conceptual model for understanding the traditional inspection pipeline.
- Packet decoding
- Preprocessing
- Detection engine
- Rule processing
- Output and logging
A more modular inspection architecture designed around inspectors, application awareness and improved processing organisation.
- Modular inspectors
- Protocol awareness
- Application identification
- Rule groups
- Parallel resource utilisation
Protocol inspection creates deeper visibility
Packet headers tell the security system where traffic is going and which transport protocol is being used. Protocol inspection can provide a much richer view of what the traffic is actually doing.
For example, an HTTPS flow may be permitted because TCP port 443 is allowed, while deeper inspection evaluates additional characteristics of the session. The important engineering principle is that the transport port identifies a communication channel; it does not, by itself, prove that the application behaviour within that channel is benign.
Inline and passive inspection are different operational models
An IPS can operate in a position where it is able to influence traffic, or it can observe traffic and generate security events without directly enforcing the result. These modes produce different operational consequences.
In an inline design, a detection can potentially influence whether traffic continues. In a passive design, the detection becomes primarily observational evidence and another control may be required to prevent the activity.
An IPS alert is not the same thing as an IPS block. When analysing an event, correlate the flow, protocol, detection condition, rule or inspection result, timestamp and configured action. Only then can the engineer determine whether the IPS actually changed the fate of the traffic.
Security telemetry connects detection to investigation
Detection becomes operationally useful when it can be correlated with the surrounding network evidence. The source and destination of the flow, the firewall decision, the inspection event and the resulting action should form a coherent timeline.
This is particularly important when a legitimate application is accidentally classified as suspicious. Without the surrounding flow and application context, an engineer may respond to the alert while missing the actual cause of the service failure.
Evidence to correlate
From detection to security decision
The complete security path is therefore broader than a simple packet-to-rule comparison. Traffic must first become understandable to the inspection engine, then gain flow and protocol context, then be evaluated against detection logic before a security action can occur.
That model also explains why security troubleshooting often requires multiple evidence sources. A packet capture may prove what was sent. A firewall record may prove how the flow was handled. An IPS event may explain what the inspection engine detected. Together, these observations provide a much stronger explanation than any single log entry.
The goal is to reconstruct the inspection path: what traffic entered, how the flow was identified, what the protocol inspector observed, which detection logic matched, what security condition was identified and what action followed.
The next interactive lab turns this pipeline into a live investigation. Step through packet decoding, flow context, protocol inspection, rule matching, detection and IPS action to see exactly where security evidence is created.
Snort 3 Inspection Pipeline
Snort 3 processes traffic through a sequence of decoding, flow, protocol and detection stages. Select a stage below to explore how traffic moves from raw packets toward a security decision.
Packet — Traffic Arrives
Network traffic reaches the inspection engine. Snort begins processing the packet so that protocol and security information can be extracted for subsequent inspection stages.
Snort 2
Snort 2 used a more process-oriented architecture built around packet decoding, preprocessors and the detection engine. Its architecture could involve duplicated processing and memory overhead as deployments scaled.
Snort 3
Snort 3 introduces a more modular, multi-threaded architecture with shared configuration and reusable inspectors. This provides a more flexible foundation for protocol analysis and efficient traffic processing.
Security Investigation: Following Evidence Through the Firewall
Real security investigations rarely begin with a known technical cause. They begin with a symptom: an application is slow, a connection fails, users report intermittent access or a security alert appears at an unexpected time. The engineer must then work backwards from that symptom and determine which part of the security path actually changed the outcome.
This requires a different mindset from simply checking whether a firewall rule exists. A configured rule describes intended behaviour. Telemetry, packet captures, connection state, inspection events and application observations provide evidence of what actually happened.
The investigation therefore follows the traffic through the security stack rather than jumping immediately to a conclusion.
Start with the symptom
A client at 10.20.4.15 is attempting to reach an application at 203.0.113.20:443. Some requests succeed while others fail or time out. The firewall is known to permit HTTPS traffic, but an IPS event has also appeared around the time of several failures.
At this point there are several possible explanations. The presence of an IPS alert makes it interesting, but it does not make the IPS responsible. The investigation must establish what happened to the actual flow.
Follow the evidence chain
Build the timeline before changing anything
Intermittent problems are particularly dangerous because different requests can take different paths through the security system. An alert at 10:03:14 and an application timeout at 10:03:15 may be related, but the timestamps alone do not establish causation.
Start by constructing a timeline around a specific failed transaction. Record the client, destination, protocol, ports and timestamp. Then correlate the flow with firewall state, policy decisions, translation records and IPS events.
Possible fault domains
The investigation should keep multiple hypotheses open until evidence eliminates them. A firewall or IPS incident can involve several layers that appear similar from the application's perspective.
Use packet capture as evidence, not as the whole investigation
Tools such as tcpdump and Wireshark are valuable because they show what traffic is actually visible at a capture point. They can establish whether packets were transmitted, whether responses returned and whether retransmissions or resets are present.
However, a packet capture from one interface cannot automatically prove what happened elsewhere in the security stack. A packet disappearing after the firewall does not by itself distinguish between policy enforcement, NAT behaviour, IPS action, routing or an upstream failure.
Capture location therefore becomes part of the evidence. Engineers need to understand where the packet was observed relative to the security controls being investigated.
Do not confuse correlation with causation
An IPS event occurring at approximately the same time as an application failure is useful evidence, but it does not prove that the IPS caused the failure. Confirm the affected flow, the detection condition, the configured action and the resulting packet behaviour before assigning causality.
This distinction becomes especially important when investigating false positives. A legitimate application can trigger an inspection condition while another dependency is responsible for the actual outage. Treating every security alert as the root cause can lead to unnecessary policy changes and can make the original problem harder to reproduce.
Compare successful and failed traffic
Intermittent failures provide an important opportunity: successful transactions can become the baseline against which failed transactions are compared.
Engineering evidence
A strong incident record should allow another engineer to reconstruct the transaction without relying on assumptions. At minimum, establish the timeline, flow tuple, firewall state, policy result, NAT behaviour, inspection event, configured action and endpoint or application result.
Do not stop at the first interesting log entry. Continue through the security path until you can explain where the expected behaviour changed. The strongest root-cause statement identifies the control, evidence and resulting traffic behaviour together.
From observation to fault isolation
The investigation model developed here can now be turned into an operational exercise. Instead of being told which component is faulty, the engineer should inspect the available evidence and determine whether the problem lies in policy, state, NAT, IPS inspection, application behaviour or an external dependency.
The objective is not simply to identify a suspicious event. It is to explain the complete chain from client request to security decision and prove which observation distinguishes the real fault from the competing hypotheses.
The next interactive lab presents the incident as an evidence problem. Inspect the client flow, firewall state, policy, NAT, IPS telemetry and application evidence, then isolate the fault and build a defensible root-cause explanation.
| Evidence | Expected | Observed | Interpretation |
|---|---|---|---|
| CLIENT | HTTPS request generated | Pending | Endpoint evidence not yet collected. |
| FLOW | Consistent 5-tuple/state | Pending | Flow state has not yet been correlated. |
| POLICY | HTTPS permitted | Pending | Policy result has not yet been confirmed. |
| NAT | Valid translation | Pending | Translation evidence has not yet been confirmed. |
| IPS | No blocking detection | Pending | IPS telemetry has not yet been correlated. |
| APPLICATION | HTTPS response | Pending | Application-side behaviour has not yet been verified. |
Operating the Security Stack: Detection, Prevention and Verification
Security operations do not end when an alert is generated or when a packet is blocked. Effective operation requires a continuous loop in which detection is correlated with context, a decision is made, a control is applied and the resulting behaviour is verified.
The firewall, IPS, threat intelligence, endpoint controls and application visibility should therefore be treated as parts of an operational system rather than isolated security products. Each control contributes a different form of evidence and each has limitations that must be understood during an investigation.
The operational question becomes: Can the security team explain what happened, why the control responded, what changed and whether the resulting security outcome is actually correct?
From detection to response
Visibility across the security stack
No single telemetry source provides the complete operational picture. Firewall telemetry explains traffic handling, IPS telemetry explains detection, endpoint telemetry provides host-level context and packet capture provides direct evidence of network behaviour.
Policy tuning and false positives
Security controls must be tuned against observed behaviour. A policy that is too broad may create excessive alerts and unnecessary intervention, while a policy that is too narrow may leave important traffic insufficiently inspected.
The same principle applies to IPS detection. A detection that repeatedly identifies legitimate application behaviour can become operational noise if it is not investigated and tuned appropriately. At the same time, suppressing a detection without understanding why it triggered can remove useful protection.
Start with evidence. Identify the traffic, understand the detection condition, establish whether the behaviour is legitimate and then determine whether a policy or detection adjustment is justified.
Avoid disabling or broadly excluding a control simply because it generates an inconvenient alert. Removing a security signal without understanding its cause can hide the original problem.
Verification is part of the change
A security change is incomplete until the resulting behaviour has been verified. Blocking a malicious flow is useful, but the engineer should also confirm that legitimate traffic remains available and that the security telemetry reflects the intended outcome.
Verification should therefore reproduce the relevant traffic and compare the observed result against the expected security policy. This turns a configuration change into an engineering change with measurable evidence.
Engineering evidence
The strongest verification demonstrates both sides of the security requirement: the unwanted traffic is prevented and legitimate traffic continues to operate as intended. Evidence should connect the policy change, observed event, enforcement result and application outcome.
Operate the stack as a feedback loop
The four sections of this guide now form one continuous engineering model. First, understand how a stateful firewall turns a packet into a security decision. Next, understand how IPS inspection adds deeper traffic analysis. Then use those models to investigate an actual failure by following evidence across the security path.
Finally, operate the controls as a feedback loop: detect an event, correlate the surrounding evidence, decide what it means, apply the appropriate prevention or policy action and verify the resulting behaviour.
Security engineering becomes more reliable when every enforcement decision can be explained by evidence and every security change can be verified against real traffic. The objective is not simply to block threats; it is to understand the complete path from network activity to security decision and prove that the resulting system behaviour is correct.
The final interactive lab turns the operational loop into a live exercise. Detect the event, correlate the evidence, decide how it should be handled, apply the prevention action and verify that the intended security outcome has actually been achieved.
- Fortinet’s new FortiOS 7.4 enhances SASE - April 5, 2023
- Comcast SD-WAN Expansion to SMBs - April 4, 2023
- Cisco CloudLock - April 4, 2023