MARS and Site-to-Site VPN networks

Question

We have a handful of remote sites that are on an IPSEC Site-to-Site vpn connection with our corporate office and the head end device is also our corporate firewall(ASA-5520) and has the IPS module installed in it.
MARS is configured to receive all events generated from the ASA firewall and the IPS sensors.
How can I exclude the vpn networks at the IP level from being subject to the interrogations. I've had to create several exclusions in the IPS module policy to stop the numerous alerts that get generated when typical windows domain traffic is flagged. This is typical behaviour for domain machines but its not typical for firewalls to expect to see. Everything is doing its job as expected but I need to stop all the alerts more efficiently and with a smaller configuration so that I don't have to exclude tcp ports, services, for each signature that is flagged.

Answer 1

I have Router 3845. i setup Radius following by link you gave me. when i try to login on router it does not login and i get following message on my Radius server's Event log.
"A RADIUS message was received from the invalid RADIUS client IP address 50.200.x.x"
50.200.x.x is my router public IP and 192.168.10.1 is private IP. i provided my router private IP in Raduis Config. please see the attched file of radius config. when i try to enter my AC user name and password in Client VPN it also does not authenticate my user.
here is my router config.
aaa new-model
aaa group server radius ITCDC001
server-private 192.168.10.15 key 7 142713181F132539207A636D754A
aaa authentication login default group ITCDC001 local
aaa authentication login vpnuser local
aaa authorization network groupauthor local
crypto isakmp policy 9
encr 3des
authentication pre-share
group 2
crypto isakmp key NetGearCisco address 203.13.x.x no-xauth
crypto isakmp client configuration group vpnclient
key cisco123
dns 192.168.10.15
domain itc.com
pool ippool
acl acl_vpn
crypto ipsec security-association lifetime seconds 86400
crypto ipsec transform-set CISCOSET esp-3des esp-sha-hmac
crypto dynamic-map dynmap 10
set transform-set CISCOSET
crypto map vpn client authentication list vpnuser
crypto map vpn isakmp authorization list groupauthor
crypto map vpn client configuration address respond
crypto map vpn 1 ipsec-isakmp
set peer 203.13.x.x
set transform-set CISCOSET
match address acl_ncsvpn
crypto map vpn 10 ipsec-isakmp dynamic dynmap