Cisco ASA Series Cli Configuration Manual page 1478

Information About the ASA IPS module
How the ASA IPS module Works with the ASA
The ASA IPS module runs a separate application from the ASA. The ASA IPS module might include an
external management interface so you can connect to the ASA IPS module directly; if it does not have a
management interface, you can connect to the ASA IPS module through the ASA interface. The ASA
IPS SSP on the ASA 5585-X includes data interfaces; these interfaces provide additional port-density
for the ASA. However, the overall through-put of the ASA is not increased.
Traffic goes through the firewall checks before being forwarded to the ASA IPS module. When you
identify traffic for IPS inspection on the ASA, traffic flows through the ASA and the ASA IPS module
as follows. Note: This example is for "inline mode." See the
information about "promiscuous mode," where the ASA only sends a copy of the traffic to the ASA IPS
module.
1.
2.
3.
4.
5.
6.
7.
8.
Figure 1-1
ASA IPS module automatically blocks traffic that it identified as an attack. All other traffic is forwarded
through the ASA.
Figure 1-1
Cisco ASA Series CLI Configuration Guide
1-2
Traffic enters the ASA.
Incoming VPN traffic is decrypted.
Firewall policies are applied.
Traffic is sent to the ASA IPS module.
The ASA IPS module applies its security policy to the traffic, and takes appropriate actions.
Valid traffic is sent back to the ASA; the ASA IPS module might block some traffic according to its
security policy, and that traffic is not passed on.
Outgoing VPN traffic is encrypted.
Traffic exits the ASA.
shows the traffic flow when running the ASA IPS module in inline mode. In this example, the
ASA IPS module Traffic Flow in the ASA: Inline Mode
Main System
inside
Diverted Traffic
IPS inspection
IPS
ASA
VPN
Firewall
Decryption
Policy
Block
Chapter 1 Configuring the ASA IPS Module
"Operating Modes" section on page 1-3
outside
for