To configure the appropriate snort engine at a device level, perform the following steps:
Go to Devices → <Admin Domain Name> → Global → IPS Device Settings → Advanced Device Settings.
The Advanced Device Settings page appears.
Uncheck the Inherit Settings? checkbox to get access to modify settings in this page.
Select Inspected Tunneled Traffic if you want to inspect GRE, GTP, and tunneled IPv4 and IPv6 traffic.
To select the snort engine, click the Snort Rule Engine dropdown and select Suricata Snort.
A pop-up appears asking you to confirm your changes and informing you that a reboot will be necessary for the change to take effect.
.png)
Click OK and then click Save at the bottom of the page.
Reboot the Sensors which require this change.
After the reboot, the Advanced Device Settings page of the Sensor displays Suricata Snort.