Question

A network engineer notices that a large, trusted database replication flow between two internal data centers is consuming significant Snort inspection resources on an FTD appliance, causing latency for other traffic. The flow is known-good and does not require deep inspection. Which FTD configuration allows this specific traffic to bypass Snort processing entirely while still being handled by the appliance?

Accepted Answer

Create a prefilter policy rule with the Fastpath action matching the flow's tunnel or source/destination criteria

Answer

Add the flow to a Security Intelligence allow list in the access control policy

Answer

Create an access control rule with the Trust action and enable file policy logging

Answer

Disable the intrusion policy globally on the access control policy default action