Cisco ASA with FirePower operational modes

[holgmark37]

Hi.

I am very new and inexperienced to the FirePower functionality and have some thoughts and questions on this topic.

We have recently invested in Cisco ASA 5515 with FirePower.

Currently it is only configured in Passive Monitor-Only Forwarding Mode.

I am thinking about getting this configured to Inline Tap Monitor-Only Mode.

If I understand the Cisco documentation correctly, I can start making policies and see what the SFR module would have done with the traffic, without actually implementing/doing anything.

The issue is, that our ASA firewalls already have been running in production for a while, and because of this have the necessary ACL’s and policies in place. We copied the main configuration from our old ASA's to the new 5515 series.

So my question is: Will configuring the SFR module in inline TAP Monitor-only Mode affect the policies already running on the ASA?

[Philip D'Ath]

No it wont.

[holgmark37]

Tnx for the reply.

But could you elaborate a little, so i understand a more how this works?

[Philip D'Ath]

If it is in monitor only mode, then it sends a copy of the data to the FirePower module that matches your service policy.