ASA app layer inspection and CX IPS inspection

Question

ASA application layer inspection is critical for protocols such as FTP and SIP for well known reasons.  When implementing a CX module, my understanding is that either the ASA implements inspection or the CX implements inspection.  For instance, if I want my CX to inspect HTTP I need to forward that traffic via a policy-map to the CX engine and ensure that the ASA is not configured to inspect HTTP.  Easy enough.
What I am unclear about is if it is desired for the CX to inspect protocols such as FTP and SIP.  In my case I'm running the CX IPS which does list some FTP and SIP threats.  If I direct this traffic to the CX for IPS inspection, where would the app layer inspection occur for processing SIP embedded IP addresses or FTP secondary channels?  Or, is it necessary to ensure these protocols remain inspected by the ASA?  Finally, does the answer change for the WSE license?   

Answer 1

Hogoqo,
Thanks for the reply. Does this config mean that "default-inspection-traffic" will not be sent to the IPS module?
What I initially wanted was to send ALL traffic to the IPS module, and also use statefull inspection for the default-inspection-traffic.
Is this a bad practice (to send all traffic to the IPS module)?
The ASA is configured with 3 interfaces (inside, outside, dmz), with an e-mail server in the DMZ. In the future, there will also be e-commerce servers in the DMZ.
Should I send to the IPS module only traffic that has the destination as one of the DMZ servers?
I am new to IPS, and kind of confused.
Thanks!