Snort & VPN Traffic

["mpapet" <mpapet () sci-s com>]

Hi,

I've been using snort on a single subnet and need to add a second subnet
that's on the other end of a peer-to-peer VPN.

The new network topology is an Active Directory domain doing DNS with two
pix 501's acting as VPN peers.  (DNS is in the local 10.10.1.x pool) Local
LAN pool 10.10.1.x remote LAN pool 10.10.2.x.  The VPN works great.  All
PC's appear to be in the same LAN.

The current eth0 watches 10.10.1.x traffic from inside the 10.10.1.x subnet.

I've changed snort.conf to include two subnets, and ran a portscan on the
test pc (address 10.10.2.4)at the other end of the VPN and I don't get any
port scan activity from snort.  The same test gets snort responses from a PC
in the 10.10.1.X subnet.

I also tried the "any"  setting as the LAN address and don't get any
responses from my second subnet either.

I may be missing the obvious solution, but I'm not a super-duper sysadmin
yet.  Any suggestions would be great.

Thanks
Michael



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users