A VPN user is unable to conned lo web resources behind the Cisco FTD device terminating the connection. While troubleshooting, the network administrator determines that the DNS responses are not…

Unchecking 'Drop when Inline' would convert all IPS blocking actions to alerts, allowing all detected malicious traffic through, which is a significant security risk and not a targeted fix for legitimate DNS.

When legitimate DNS traffic is blocked by Cisco FTD while Snort IPS rules are active, it indicates that one or more Snort rules are misidentifying and dropping the valid DNS responses. The appropriate solution is to tune or modify these specific Snort rules to allow the legitimate DNS traffic, rather than broadly disabling IPS functionality.

Disabling intrusion rule thresholds ('threshes') would impact alert generation and resource usage, but it would not resolve legitimate traffic being blocked by the rules themselves.

VPN traffic is decrypted *before* IPS inspection. The issue is Snort blocking the cleartext DNS. Attempting to decrypt *after* the VPN flow or bypass inspection entirely contradicts the requirement to 'still utilizing Snort IPS rules'.