1-2
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA IPS Module
Information About the ASA IPS module
How the ASA IPS module Works with the ASA
The ASA IPS module runs a separate application from the ASA. The ASA IPS module might include an
external management interface so you can connect to the ASA IPS module directly; if it does not have a
management interface, you can connect to the ASA IPS module through the ASA interface. The ASA
IPS SSP on the ASA 5585-X includes data interfaces; these interfaces provide additional port-density
for the ASA. However, the overall through-put of the ASA is not increased.
Traffic goes through the firewall checks before being forwarded to the ASA IPS module. When you
identify traffic for IPS inspection on the ASA, traffic flows through the ASA and the ASA IPS module
as follows. Note: This example is for “inline mode.” See the “Operating Modes” section on page 1-3 for
information about “promiscuous mode,” where the ASA only sends a copy of the traffic to the ASA IPS
module.
1. Traffic enters the ASA.
2. Incoming VPN traffic is decrypted.
3. Firewall policies are applied.
4. Traffic is sent to the ASA IPS module.
5. The ASA IPS module applies its security policy to the traffic, and takes appropriate actions.
6. Valid traffic is sent back to the ASA; the ASA IPS module might block some traffic according to its
security policy, and that traffic is not passed on.
7. Outgoing VPN traffic is encrypted.
8. Traffic exits the ASA.
Figure 1-1 shows the traffic flow when running the ASA IPS module in inline mode. In this example, the
ASA IPS module automatically blocks traffic that it identified as an attack. All other traffic is forwarded
through the ASA.
Figure 1-1 ASA IPS module Traffic Flow in the ASA: Inline Mode
ASA
Main System
IPS
Diverted Traffic
IPS inspection
VPN
Decryption
Firewall
Policy
Block
251157
inside
outside
To Next Page
Loading...
Need help?
General
