Remember daemonlogger, you don’t need another sensor in front of firewall, all you need is a software tap(inline box) and transmit the pcap to your sguil box, just add another nic if you have enough pci slot will do.