Cisco ASA 5506-X Configuration Manual page 373

Chapter 17 ASA CX Module
Figure 17-1
Service Policy in Monitor-Only Mode
For testing and demonstration purposes, you can configure the ASA to send a duplicate stream of
read-only traffic to the ASA CX module, so you can see how the module inspects the traffic without
affecting the ASA traffic flow. In this mode, the ASA CX module inspects the traffic as usual, makes
policy decisions, and generates events. However, because the packets are read-only copies, the module
actions do not affect the actual traffic. Instead, the module drops the copies after inspection. The
following figure shows the ASA CX module in monitor-only mode.
Figure 17-2
Traffic-Forwarding Interface in Monitor-Only Mode
You can alternatively configure ASA interfaces to be traffic-forwarding interfaces, where all traffic
received is forwarded directly to the ASA CX module without any ASA processing. For testing and
demonstration purposes, traffic-forwarding removes the extra complication of ASA processing.
Traffic-forwarding is only supported in monitor-only mode, so the ASA CX module drops the traffic
after inspecting it. The following figure shows the ASA GigabitEthernet 0/3 interface configured for
traffic-forwarding. That interface is connected to a switch SPAN port so the ASA CX module can inspect
all of the network traffic.
ASA CX Module Traffic Flow in the ASA
Main System
inside
Diverted Traffic
Block
ASA CX inspection
ASA CX Monitor-Only Mode
Main System
inside
Copied Traffic
ASA CX inspection
ASA CX
ASA
VPN
Firewall
Decryption
Policy
ASA CX
ASA
VPN
Firewall
Decryption
Policy outside
Cisco ASA Series Firewall CLI Configuration Guide
The ASA CX Module
outside
17-3