Firepower and Scansafe CWS

[GRANT3779]

Hi,

I have been reading the following -

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html

It states the following -

Do not configure Cloud Web Security (ScanSafe) inspection on traffic that you send to the ASA FirePOWER module. If traffic matches both your Cloud Web Security and ASA FirePOWER service policies, the traffic is forwarded to the ASA FirePOWER module only. If you want to implement both services, ensure there is no overlap between the traffic matching criteria for each service.

When it says "ensure no overlap, if you want to use both services" what exactly would be used here?
I have CWS configured on a number of ASAs which are soon to be enabled for Firepower also. For CWS we are matching on ACL (http and https). If I want to send web traffic to the Firepower module also what would be required?

[Philip D'Ath]

You really should only need to use one ... but I think if you enable the policies on different interfaces (inside and outside for example) you should be ok.  You just can't enable both policies at the same time globally or per interface.

[rrfield]

I wonder if this would apply to only in-line mode, or passive / monitor only mode as well?