Optimal placement on Internet facing router

Optimal placement on Internet facing router

I am trying to use the NFA to monitor inbound/outbound traffic on our internet facing router. The only way I have got this to work is to put the client running the analyzer on the internet side of the router and send flows to this. I havent figured out how to punch a hole in my PIX to send the flows from outside to inside.

Curious what others are doing in this same situation.

                New to ADSelfService Plus?