We have a small office, about 75% of our infrastructure is cloud based including a pfSense deployment we use for remote access and site to site connections which is currently public facing. We've decided to deploy a Cisco ASA with Firepower support as our on-premise perimeter firewall.
Does anyone have experience with using IPS features included with Firepower licensing and/or pfSense with the Suricata package installed running in inline mode and how VPN traffic is handled? Since we're connecting to a VPN server managed by pfSense, to meet compliance needs we need to figure out exactly where packet inspection occurs.
With an IPsec VPN client connecting from our on-premise ASA to pfSense, would the ASA decrypt packets and forward them to the Firepower module for inspection before getting routed, or would this be handled on the pfSense/Suricata end before or after packets are sent from the VPN server to the ASA?