Cisco Systems and the ASA Services Module Manual De Usuario

The ASA IPS module runs a separate application from the ASA. The ASA IPS module might include an 
external management interface so you can connect to the ASA IPS module directly; if it does not have a 
management interface, you can connect to the ASA IPS module through the ASA interface. The ASA 
IPS SSP on the ASA 5585-X includes data interfaces; these interfaces provide additional port-density 
for the ASA. However, the overall through-put of the ASA is not increased.

Traffic goes through the firewall checks before being forwarded to the ASA IPS module. When you 
identify traffic for IPS inspection on the ASA, traffic flows through the ASA and the ASA IPS module 
as follows. Note: This example is for “inline mode.” See the 

 

for information about “promiscuous mode,” where the ASA only sends a copy of the traffic to the ASA 
IPS module.

Traffic enters the ASA.

Incoming VPN traffic is decrypted.

Firewall policies are applied.

Traffic is sent to the ASA IPS module.

The ASA IPS module applies its security policy to the traffic, and takes appropriate actions.

Valid traffic is sent back to the ASA; the ASA IPS module might block some traffic according to its 
security policy, and that traffic is not passed on.

Outgoing VPN traffic is encrypted.

Traffic exits the ASA.

 shows the traffic flow when running the ASA IPS module in inline mode. In this example, 

the ASA IPS module automatically blocks traffic that it identified as an attack. All other traffic is 
forwarded through the ASA.

Diverted Traffic

IPS inspection

VPN

Decryption

Firewall

Policy

Block

251

157

inside

outside