Cisco Systems ASA 5580 Manual De Usuario

For demonstration purposes, you can configure a service policy or a traffic-forwarding interface in 
monitor-only mode.

For guidelines and limitations for monitor-only mode, see the 

.

For testing and demonstration purposes, you can configure the ASA to send a duplicate stream of 
read-only traffic to the ASA CX module, so you can see how the module inspects the traffic without 
affecting the ASA traffic flow. In this mode, the ASA CX module inspects the traffic as usual, makes 
policy decisions, and generates events. However, because the packets are read-only copies, the module 
actions do not affect the actual traffic. Instead, the module drops the copies after inspection. 

shows the ASA CX module in monitor-only mode.

You can alternatively configure ASA interfaces to be traffic-forwarding interfaces, where all traffic 
received is forwarded directly to the ASA CX module without any ASA processing. For testing and 
demonstration purposes, traffic-forwarding removes the extra complication of ASA processing. 
Traffic-forwarding is only supported in monitor-only mode, so the ASA CX module drops the traffic 
after inspecting it. 

 shows the ASA GigabitEthernet 0/3 interface configured for 

traffic-forwarding. That interface is connected to a switch SPAN port so the ASA CX module can inspect 
all of the network traffic.

inside

ASA CX inspection

outside

VPN

Decryption

Firewall

Policy

Copied Traffic

3

0

3

69

8