Cisco ASA 5506-X Configuration Manual page 400

Information About the ASA IPS Module
How the ASA IPS Module Works with the ASA
The ASA IPS module runs a separate application from the ASA. The ASA IPS module might include an
external management interface so you can connect to the ASA IPS module directly; if it does not have a
management interface, you can connect to the ASA IPS module through the ASA interface. The ASA
IPS SSP on the ASA 5585-X includes data interfaces; these interfaces provide additional port-density
for the ASA. However, the overall through-put of the ASA is not increased.
Traffic goes through the firewall checks before being forwarded to the ASA IPS module. When you
identify traffic for IPS inspection on the ASA, traffic flows through the ASA and the ASA IPS module
as follows. Note: This example is for "inline mode." See
about "promiscuous mode," where the ASA only sends a copy of the traffic to the ASA IPS module.
1.
2.
3.
4.
5.
6.
7.
8.
Figure 18-1
the ASA IPS module automatically blocks traffic that it identified as an attack. All other traffic is
forwarded through the ASA.
Figure 18-1
Operating Modes
You can send traffic to the ASA IPS module using one of the following modes:
•
Cisco ASA Series Firewall CLI Configuration Guide
18-2
Traffic enters the ASA.
Incoming VPN traffic is decrypted.
Firewall policies are applied.
Traffic is sent to the ASA IPS module.
The ASA IPS module applies its security policy to the traffic, and takes appropriate actions.
Valid traffic is sent back to the ASA; the ASA IPS module might block some traffic according to its
security policy, and that traffic is not passed on.
Outgoing VPN traffic is encrypted.
Traffic exits the ASA.
shows the traffic flow when running the ASA IPS module in inline mode. In this example,
ASA IPS module Traffic Flow in the ASA: Inline Mode
Main System
inside
Diverted Traffic
IPS inspection
IPS
Inline mode—This mode places the ASA IPS module directly in the traffic flow (see
No traffic that you identified for IPS inspection can continue through the ASA without first passing
through, and being inspected by, the ASA IPS module. This mode is the most secure because every
ASA
VPN
Firewall
Decryption
Policy
Block
Chapter 18
Operating Modes, page 18-2
outside
ASA IPS Module
for information
Figure 18-1).