Hi out there
I have a - probably simple - problem with a Cisco ASA 5510 with a SSM10module. We NAT through the outside interface - through the global policy:
service-policy IPS interface outside
have we assigned the IPS to the outside interface. We direct the traffic through a few simple maps:
class-map inspection_default
match default-inspection-traffic
class-map ips-default
match access-list ips_default-inbound_vs0
!
the access-list ips_default-inbound_vs0 looks like this:
access-list ips_default-inbound_vs0 extended deny ip 205.0.0.0 255.0.0.0 any
access-list ips_default-inbound_vs0 extended deny ip 206.0.0.0 255.0.0.0 any
access-list ips_default-inbound_vs0 extended permit ip any any
whereby I expect to bypass the sensor vs0 with traffic from 206.164.26.128 - but it looks as if it does hit the last entry in the ACL instead
I wonder in what order the access-list is evaluated - as far as I remember the acl will be "converted" to the real ip-adresse and not the NAT'ed before evaluated but I am a bit in doubt when I look on the result...
Btw - what throughput can we expect on these boxes - we are running a 100mbps fiber link but cannot get more that 20-30 mbps through the box when passed thorugh the ips
best regards /ti
