A security architect is documenting packet handling on a Secure Firewall Threat Defense device for a design review. One engineer says inspection happens before the stateful engine builds the connection, while another says Snort acts as a reporting-only tool in every deployment mode. Which statement about the path through the Lina and Snort engines is correct?
Select an answer to reveal the explanation.
Short Explanation
You've got the order right, because the firewall engine sets up the session first and the inspection engine reviews what flows through it. A front desk checks you in before the guard watches your bag, and your packet follows that same path. The part to remember is that inline mode lets Snort stop the packet after Lina has already tracked the session.
Full Explanation
Threat Defense combines the ASA-based Lina engine, which owns interfaces, routing, NAT, the connection table and access control decisions, with the Snort engine, which performs stateful inspection and intrusion prevention. A packet is accepted by Lina, its connection is created and tracked, and the payload is then handed to Snort for inspection, where an inline verdict is applied back in the forwarding path so a match can still drop the packet. Inspecting before connection setup fails because no session, NAT translation or route context exists yet for the engine to evaluate. The reporting-only view fails because it ignores inline mode, where the Snort drop decision directly stops a packet mid-flow. Bypassing the connection table fails because Lina keeps tracking state for inspected flows, which is what makes later packets and teardown behave correctly. Exam caveat: the balance shifts with deployment mode, since a passive sensor only reports. Practical check: confirm the interface and rule actions, then look for connection events alongside Snort alerts for the same flow.