preprocessor ftp_telnet_protocol: \
telnet \
ports { 23 } \
normalize \
ayt_attack_thresh 6 \
detect_anomalies
There should only be a single telnet configuration, and subsequent instances will override previously set values.