Cisco ASA 5506-X Configuration Manual page 344

The ASA FirePOWER Module
Figure 16-2
ASA FirePOWER Passive Monitor-Only Traffic Forwarding Mode
If you want to operate the ASA FirePOWER module as a pure Intrusion Detection System (IDS), where
there is no impact on the traffic at all, you can configure a traffic forwarding interface. A traffic
forwarding interface sends all received traffic directly to the ASA FirePOWER module without any ASA
processing.
The module applies the security policy to the traffic and lets you know what it would have done if it were
operating in inline mode; for example, traffic might be marked "would have dropped" in events. You can
use this information for traffic analysis and to help you decide if inline mode is desirable.
Traffic in this setup is never forwarded: neither the module nor the ASA sends the traffic on to its
ultimate destination. You must operate the ASA in single context and transparent modes to use this
configuration.
The following figure shows an interface configured for traffic-forwarding. That interface is connected to
a switch SPAN port so the ASA FirePOWER module can inspect all of the network traffic. Another
interface sends traffic normally through the firewall.
Figure 16-3
Cisco ASA Series Firewall CLI Configuration Guide
16-4
ASA FirePOWER Inline Tap Monitor-Only Mode
Main System
inside
Copied Traffic
ASA FirePOWER
inspection
ASA FirePOWER
ASA FirePOWER Passive Monitor-Only, Traffic-Forwarding Mode
ASA
Main System
inside
Firewall
Policy
ASA FirePOWER
inspection
ASA FirePOWER
ASA
VPN
Firewall
Decryption
Policy outside
VPN
Gig 1/1
Decryption
Gig 1/3
Forwarded Traffic
Chapter 16 ASA FirePOWER (SFR) Module
Switch
outside
SPAN
Port