Hi Can anyone explain how IPS works in ASA firewalls and SSL/IPSEC VPN configurations?
You have to distinguish three scenarios:
1) IPSec/SSL through the ASA with the IPS-module
The IPS can not look into the encrypted traffic, but can analyse the cleartext-headers for attacks. To inspect the payload you need an IPS-apliance that sits behind the VPN-termination-point.
2) IPSec and SSL-VPNs (tunneled) that are terminated on the ASA
This traffic can be inspected by the IPS-module in the ASA.
3) clientless SSL terminated on the ASA
This traffic is not inspected by the IPS-module in the ASA.
-- Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: