Do I send all traffic through the CX or just some?

Which direction or both?

I did try to use the global policy and I had some issues with that. I will try again as maybe I missed something.

Also I need to make sure the ASA is not inspecting the HTTP traffic, correct?

Is there any other traffic that I should make sure the ASA does not inspect?

Will setting this up disrupt traffic?

Are there any step by steps for this? I could not seem to find any this about setting up the service policy specific to the traffic going to the CX module.

Mike

Thank you for your help...so based on all this see if this is correct.

Current Config

policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp

********************************
Make these changes

policy-map global_policy
class class-default
cxsc fail-open

*****************************

Result

policy-map global_policy
 class class-default
  cxsc fail-open
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp

That's it? I actually had found that but it seemed to easy so I did not think that was it.

Mike

Yes, that's all it takes to redirect the flows through the ASA into the CX module.

When you modify the policy-map the parser will actually put the class-default at the end of that configuration section instead of in the beginning as you showed in your reply.

Thanks for your help.

Mike

You're welcome. Thanks for the ratings.

I was thinking about your question about impact. If you don't have a lab to work in ahead of time you can selectively choose to redirect only a single host or subnet to the CX module by defining it with an ACL and then trying out only that subset of your traffic in the CX policy regime.

Thanks for the info. I am going to do it on site early so I should be good to test and roll back as needed.

Thanks and have a great weekend.

Mike