AIP-SSM configuration / blocking SMTP

Question

Hi all,
I need some help regarding a deployment of a IPS module on a ASA. I configured it in transparent mode, with the intention to only monitor the traffic going through the module. Otherwise after aplying the policy and put it in operation, it started blocking SMTP and ICMP traffic. Here follows the configuration applied to it:
class-map outside-class
match any
policy-map outside-policy
class outside-class
ips promiscuous fail-open
service-policy outside-policy interface outside
Is there anything else I should consider to put this module just monitoring the traffic instead of having it denying any traffic?
Thanks in Advance

Answer 1

You may need to create an access-list permitting all traffic, and then apply the access-list to both interfaces in both directions (in and out).
This will ensure connections can go from the lower security zone to the higher as well as from the higher security zone to the lower.
You may also need to add icmp permit lines to permit icmp traffic through each interface.