Configure ASA5515-X with IPS as standalone IPS.

[JonPBerbee]

There are instances in our organization when our customers need to have a standalone IPS device due to environment restrictions.  In the past we used the 4240 sensors which are now, or soon to be, EOL.  The upgrade path is the ASA 5515-X with IPS services and I have heard that the device will be able to operate as a standalone IPS device.

Does anyone know if this is indeed possible or does anyone have experience configuring the device this way?  It'd definitely be cheaper than going with the 4300 devices so I'd be interested in feedback on this.

[rhermes]

We've done this with ASA5500 models, so it's a safe bet you could do this with the ASA5500x devices as well.

The difference between using an ASA and an appliance for an IPS sensor is there's all sorts of firewall technology that you'll need to disable (as much as possible at least, you can't turn it all off) and I believe the sensor will be blind to layer 2 attacks.

- Bob