Doubt About IPS - Firepower

[crusier2015]

Hi,

Suppose that I configure the follow, the IPS function will audit and act only based on traffic redirect for module as configured?

class-map SFR
match access-list SFR

policy-map global_policy
class SFR
sfr fail-open

access-list SFR extended permit tcp any any eq http
access-list SFR extended permit tcp any any eq https

 tks

[Oliver Kaiser]

Your current configuration will forward all tcp/80 and tcp/443 traffic to your firepower module for inspection. If drop is configured in your ips policy on firepower, traffic will be tagged and dropped by asa. If you only want to monitor traffic using your module, you may want to adapt your configuration to monitor-only mode.

ASA(config) # policy-map global_policy
ASA(config-pmap) # class SFR
ASA(configäpmap-c) # sfr fail-open monitor-only