Suricata as IDS and IPS on transpararent mode

Help
1

Hi team!

New around here and new to Suricata too.

We have a setup (multiple, actually) where all of our devices connect to L2 switches. Those L2 switches in turn connect to an L3 switch, not ours, routing us to another network, nor ours too.

We are planning to set up Suricata both as an IDS and IPS and i am wondering if we can set all this up as a transparent IDS/IPS:

SURICATA
SURICATA850×1100 31.1 KB

I know Suricata can be set up in transparent mode, I don’t know if we can do that with multiple interfaces.

Any advice/tips would be appreciated.

Thanks!

2

Is there a routing logic that would have to be implemented or are there direct relations?
For example is everything from eth0 meant to be forwarded to eth2 and vice versa?
You could run dedicated instances for each interface pair in af-packet IPS mode or, if there is more routing logic needed, you can go the NFQueue way.