I think the Best design is to use the IPS behind the ASA.
in your case here is what I have found:
Traffic inspected by a sensor outside a firewall tends to be unregulated. Sensors monitoring
traffic outside a firewall see scans, sweeps, and every Internet worm and attack that exists,
along with potentially large numbers of spoofed packets from around the globe. This makes it
much more difficult to distinguish true alarms from noise or false alarms. A possible strategy
for a sensor outside a firewall is to use the event stream from the sensor to identify trends.
When the sensor is outside the firewall, consider these tuning guidelines:
- Avoid assigning a high severity level to any individual event.
- Turn off all response actions.
- Use the sensor primarily to look for trends on the Internet such as activity explosions,
which can indicate attacks like Code Red or Nimda.
you should do moniting using IME, this may be helpful to know why the load is 100% :(
I hope this is useful.
Reda
