Traffic flow illustrating how ASA handles FirePOWER services module traffic flow
•Traffic enters the ASA.
•Incoming VPN traffic is decrypted (If using VPN).
•Firewall policies are applied.
•Traffic is sent to the ASA FirePOWERmodule.
•The ASA FirePOWERmodule applies its security policy to the traffic, and takes appropriate actions.
•Valid traffic is sent back to the ASA; the ASA FirePOWERmodule might block some traffic according to its security policy, and that traffic is not passed on.
•Outgoing VPN traffic is encrypted.
•Traffic exits the ASA.