30-3
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter30 Configuring the ASA CX Module
Information About the ASA CX Module
Monitor-Only Mode
For demonstration purposes, you can configure a service policy or a traffic-forwarding interface in
monitor-only mode.
For guidelines and limitations for monitor-only mode, see the “Guidelines and Limitations” section on
page 30-6.
•Service Policy in Monitor-Only Mode, page30-3
•Traffic-Forwarding Interface in Monitor-Only Mode, page30-3

Service Policy in Monitor-Only Mode

For testing and demonstration purposes, you can configure the ASA to send a duplicate stream of
read-only traffic to the ASA CX module, so you can see how the module inspects the traffic without
affecting the ASA traffic flow. In this mode, the ASA CX module inspects the traffic as usual, makes
policy decisions, and generates events. However, because the packets are read-only copies, the module
actions do not affect the actual traffic. Instead, the module drops the copies after inspection. Figure30-2
shows the ASA CX module in monitor-only mode.
Figure30-2 ASA CX Monitor-Only Mode

Traffic-Forwarding Interface in Monitor-Only Mode

You can alternatively configure ASA interfaces to be traffic-forwarding interfaces, where all traffic
received is forwarded directly to the ASA CX module without any ASA processing. For testing and
demonstration purposes, traffic-forwarding removes the extra complication of ASAprocessing.
Traffic-forwarding is only supported in monitor-only mode, so the ASA CX module drops the traffic
after inspecting it. Figure 30-3 shows the ASA GigabitEthernet 0/3 interface configured for
traffic-forwarding. That interface is connected to a switch SPAN port so the ASA CX module can inspect
all of the network traffic.
ASA
Main System
inside
ASA CX
ASA CX inspection
outside
VPN
Decryption
Firewall
Policy
Copied Traffic
303698