I have traffic flow which is feed to Suricata.
Below is the traffic detail which is feed to Suricata in IPS mode via TAP interfaces,
- In one direction, traffic is VxLAN encapsulated
- In another direction, traffic is without VxLAN encapsulation
Will this cause issue for Suricata to detect/block traffic ?
For Suricata to work in IPS mode, it has to be installed inline (not via tap) otherwise it will drop a copy of the packet and not the actual one.
Other things that comes to mind from the VLAN situation:
- make sure use-for-tracking is set to false in suricata.yaml.
- if you are using rss to distribute traffic to multiple queues in your NIC, make sure vlan header is ignored, or use a single queue.
Suricata will be running on AF-PACKET TAP interfaces (in and out) and physical interfaces will be connected to tap interfaces via bridge in IPS mode.
Oh, pardon me for misreading the question, however I think the two other points might be still valid.
So you’re talking about TAP interfaces and IPS mode with a bridge. Can you draw the setup and be more precise on what part Suricata would be running?
Depending on the details it could be an issue or not.