In a hosting space within data center where high-speed internet connectivity is provided, is it feasible to plug the internet line directly into the ACE 4710 i.e. hits the VIP first. So SSL offloading happens on the ACE and while on the way to Rservers, ASA IPS and Content Security is deployed for one-stop decrypted traffic scan. Following the scan it hits the designated Rserver.

Topology

Internet -> ACE -> ASA with IPS -> ASA with Anti-X -> Rserver

Is this a good alternative ?

With ASA-IPS solution the maximum throughput you get is 650Mbps (If you are using ASA 5540 with SSM-40 card in it). ACE-Appliance's throughput (1, 2, or 4 Gbps) is much more than that.

I am not sure what are your expected throughputs but When Higher throughput is desired then ACE Appliance + ASA IPS is not a scalable/valid solution.

With higher throughput you need ACE Module (options: 16 Gbps, 8 Gbps, and 4 Gbps) and IPS 42xx appliances that give you up to 4Gbps throughput.

Again the problem is If the traffic is encrypted then there is no way you can analyze packets before they are decrypted. You need to decrypt it using some SSL-offloader (like ACE)and only then IPS will be able to analyze the data in the packets.

HTH

Syed Iftekhar Ahmed

So in the given topology if ACE becomes the internet edge device i.e. first device exposed to internet, wouldn't it be security risk. Because ACE configuration would have IP and other details of the all Rservers. And if the ACE is hacked, all server information would be visible to the intruder. So is it secure ?

You dont need to place ACE as the internet facing edge device. You can use an ASA context in front of ACE.

Syed