Does an ASA inspect traffic traversing a VPN?

[justinmitchell]

Does an ASA inspect traffic traversing a VPN using the default inspect rules?

[Federico Coto Fajardo · Accepted solution]

Hi Justin,

The ASA can inspect traffic prior encryption or post decryption. The ASA cannot inspect encrypted traffic.

This means that if the VPN tunnel terminates on the ASA, the ASA could inspect the traffic sent through the tunnel prior encryption and could inspect the traffic post decryption when received.

If the tunnel does not terminate on the ASA but instead passes through the ASA, the ASA cannot inspect the traffic encapsulated inside.

Hope it helps.

Federico.

[justinmitchell]

Thank you for the reply. I knew it couldn't inspect the encrypted traffic, just wasn't sure if it only inspected traffic truly passing through it from a private host to a public, or all traffic entering the interface even if it is going to be encrypted and sent to another private host.