Filter
Top Products
30-7
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 30 Configuring the ASA CX Module
Guidelines and Limitations
Firewall Mode Guidelines
Supported in routed and transparent firewall mode. Traffic-forwarding interfaces are only supported in
transparent mode.
Failover Guidelines
Does not support failover directly; when the ASA fails over, any existing ASA CX flows are transferred
to the new ASA, but the traffic is allowed through the ASA without being inspected by the ASA CX.
ASA Clustering Guidelines
Does not support clustering.
IPv6 Guidelines
• Supports IPv6.
• (9.1(1) and earlier) Does not support NAT 64. In 9.1(2) and later, NAT 64 is supported.
Model Guidelines
• Supported only on the ASA 5585-X and 5512-X through ASA 5555-X. See the Cisco ASA
Compatibility Matrix for more information:
http://www.cisco.com/en/US/docs/security/asa/compatibility/asamatrx.html
• For the 5512-X through ASA 5555-X, you must install a Cisco solid state drive (SSD). For more
information, see the ASA 5500-X hardware guide.
Monitor-Only Mode Guidelines
• You cannot configure both monitor-only mode and normal inline mode at the same time on the ASA.
Only one type of security policy is allowed. In multiple context mode, you cannot configure
monitor-only mode for some contexts, and regular inline mode for others.
• The following features are not supported in monitor-only mode:
–
Deny policies
–
Active authentication
–
Decryption policies
• The ASA CX does not perform packet buffering in monitor-only mode, and events will be generated
on a best-effort basis. For example, some events, such as ones with long URLs spanning packet
boundaries, may be impacted by the lack of buffering.
• Be sure to configure both the ASA policy and the ASA CX to have matching modes: both in
monitor-only mode, or both in normal inline mode.
Additional guidelines for traffic-forwarding interfaces:
• The ASA must be in transparent mode.
• You can configure up to 4 interfaces as traffic-forwarding interfaces. Other ASA interfaces can be
used as normal.
• Traffic-forwarding interfaces must be physical interfaces, not VLANs or BVIs. The physical
interface also cannot have any VLANs associated with it.
• Traffic-forwarding interfaces cannot be used for ASA traffic; you cannot name them or configure
them for ASA features, including failover or management-only.
• You cannot configure both a traffic-forwarding interface and a service policy for ASA CX traffic.