Filter
Top Products
30-3
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 30 Configuring the ASA CX Module
Information About the ASA CX Module
Monitor-Only Mode
For demonstration purposes, you can configure a service policy or a traffic-forwarding interface in
monitor-only mode.
For guidelines and limitations for monitor-only mode, see the “Guidelines and Limitations” section on
page 30-6.
• Service Policy in Monitor-Only Mode, page 30-3
• Traffic-Forwarding Interface in Monitor-Only Mode, page 30-3
Service Policy in Monitor-Only Mode
For testing and demonstration purposes, you can configure the ASA to send a duplicate stream of
read-only traffic to the ASA CX module, so you can see how the module inspects the traffic without
affecting the ASA traffic flow. In this mode, the ASA CX module inspects the traffic as usual, makes
policy decisions, and generates events. However, because the packets are read-only copies, the module
actions do not affect the actual traffic. Instead, the module drops the copies after inspection. Figure 30-2
shows the ASA CX module in monitor-only mode.
Figure 30-2 ASA CX Monitor-Only Mode
Traffic-Forwarding Interface in Monitor-Only Mode
You can alternatively configure ASA interfaces to be traffic-forwarding interfaces, where all traffic
received is forwarded directly to the ASA CX module without any ASA processing. For testing and
demonstration purposes, traffic-forwarding removes the extra complication of ASA processing.
Traffic-forwarding is only supported in monitor-only mode, so the ASA CX module drops the traffic
after inspecting it. Figure 30-3 shows the ASA GigabitEthernet 0/3 interface configured for
traffic-forwarding. That interface is connected to a switch SPAN port so the ASA CX module can inspect
all of the network traffic.
ASA
Main System
inside
ASA CX
ASA CX inspection
outside
VPN
Decryption
Firewall
Policy
Copied Traffic
303698