Cisco
Login
Search

Intrusion Detection and Prevention Migrate from Snort 2 to Snort 3 How to Migrate from Snort 2 to Snort 3 Convert Snort 2 Custom IPS Rules to Snort 3 Convert Snort 2 Custom Rules of a Single Intrusion Policy to Snort 3

Last updated: Aug 18, 2025

Convert Snort 2 Custom Rules of a Single Intrusion Policy to Snort 3

Procedure

1

Choose Policies > Intrusion.

2

In the Intrusion Policies tab, click Show Snort 3 Sync status.
3

Click the Sync icon Snort out-of-Sync (snort versions out-of-sync) of the intrusion policy.


 

If the Snort 2 and the Snort 3 versions of the intrusion policy are synchronized, then the Sync icon is in greenSnort in-Sync (snort versions in-sync). It indicates that there are no custom rules to be converted.
4

Read through the summary and click the Custom Rules tab.
5

Choose:

  • Import converted rules to this policy—To convert the Snort 2 custom rules in the intrusion policy to Snort 3 and import them into Firewall Management Center as Snort 3 custom rules.

  • Download converted rules—To convert the Snort 2 custom rules in the intrusion policy to Snort 3 and download them into your local system. You can review the converted rules in the downloaded file and later upload the file by clicking the upload icon.
6

Click Re-Sync.

What to do next

Deploy configuration changes; see Deploy Configuration Changes.

Previous topic Convert all Snort 2 Custom Rules across all Intrusion Policies to Snort 3 Next topic View Snort 2 and Snort 3 Base Policy Mapping