Interface Configuration for Suricata

[spetrillo]

Hello all,

I have built a bare metal OPNsense server. I have enabled IDS/IPS but not sure which interface to configure, vlan name or actual hardware name? Which is best, especially running in promiscuous mode?

Thanks,
Steve

[crystalscrack]

I put Suricata and OPNsense to use in a production setting and learned that carefully setting up the interface is key to getting good performance. It's interesting how deeply people here talk about the specifics of setting up platforms for the best traffic inspection. I had similar problems with VLAN tagging, but using what other people had to say really sped up the process.