Cisco ASA 5506-X Configuration Manual page 361

Chapter 16 ASA FirePOWER (SFR) Module
Configure Passive Traffic Forwarding
If you want to operate the module in passive monitor-only mode, where the module gets a copy of the
traffic and neither it nor the ASA can affect the network, configure a traffic forwarding interface and
connect the interface to a SPAN port on a switch. For more details, see
Monitor-Only Traffic Forwarding Mode, page
The following guidelines explain the requirements for this deployment mode:
•
•
•
•
•
Procedure
Enter interface configuration mode for the physical interface you want to use for traffic-forwarding.
Step 1
interface physical_interface
Example:
hostname(config)# interface gigabitethernet 0/5
Step 2 Remove any name configured for the interface. If this interface was used in any ASA configuration, that
configuration is removed. You cannot configure traffic-forwarding on a named interface.
no nameif
Step 3 Enable traffic-forwarding.
traffic-forward sfr monitor-only
Note
Step 4 Enable the interface.
no shutdown
Repeat for any additional interfaces.
Examples
The following example makes GigabitEthernet 0/5 a traffic-forwarding interface:
interface gigabitethernet 0/5
no nameif
traffic-forward sfr monitor-only
no shutdown
The ASA must be in single-context and transparent mode.
You can configure up to 4 interfaces as traffic-forwarding interfaces. Other ASA interfaces can be
used as normal.
Traffic-forwarding interfaces must be physical interfaces, not VLANs or BVIs. The physical
interface also cannot have any VLANs associated with it.
Traffic-forwarding interfaces cannot be used for ASA traffic; you cannot name them or configure
them for ASA features, including failover or management-only.
You cannot configure both a traffic-forwarding interface and a service policy for ASA FirePOWER
traffic.
You can ignore any warnings about traffic forwarding being for demonstration purposes only.
This is a supported production mode.
Configure the ASA FirePOWER Module
ASA FirePOWER Passive
16-4.
Cisco ASA Series Firewall CLI Configuration Guide
16-21