Fresh install of distro. Everything updated to latest stable. The firewall is installed and disabled. I tried uninstalling and re-installing sysadmin and firewall. Only way I can get intrustion detection to work is if I enable firewall which I do not want to do.
For anyone else running into this. Apparently firewall has 2 levels of enable. There is module admin enable/disable and then there is firewall enable/disable in the GUI after it is installed and enabled in module admin. What I typically understood “disable” to mean is module disable. However, apparently it needs to be enabled in module admin but can remain disabled in the GUI settings.