FirePOWERS service configuration an existing ASA

[KarimOUATTARA0210]

Hello Expert,

We have an ASA 5525 that was running since 1 year now.

we have purchased firewpower service licenses.

We are juste interested in ips part of that service.

My question is : can asa image still handle the access-list and forward the allowed packets to firepower services  ?

Regards,

Karim

[balaji.bandi]

yes your ASA works as usal like FW, if you like to use IPS Service you need add additional configuration to intercept the traffic

look at the configuration guides :

https://www.cisco.com/c/en/us/support/security/asa-5525-x-firepower-services/model.html#ConfigurationExamplesandTechNotes

[Marvin Rhoads]

When using a Firepower service module, the ASA continues to do everything it always has (ACL, NAT, VPN etc.) with the addition of having the Firepower services module to do IPS (and URL Filtering and Advanced Malware Protection if you desire and have the licenses).

See the order of Operations for ASA packet processing diagram below for a visual illustration: