AFAIK, you can't have the IPS (snort_inline as implemented in the UTM) detect any traffic unless there is a source and destination interface configured, whether at Layer 2 or 3. Creating a bridge (layer 2) or using two interfaces (whether physical or VLAN) would be in order.
CTO, Convergent Information Security Solutions, LLC
Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
