HTTP response processing is disabled by default. You can enable it for each traffic direction on an interface pair. To minimize the potential performance impact on the Sensor, we recommend that you enable HTTP response processing on the minimum number of ports and in only the required directions to achieve your protection goals.
Some examples of HTTP response processing deployment are given below:
You want to protect a bunch of clients on your internal network — Enable HTTP response processing for outbound traffic only.
You are serving Web content to external clients, and do not wish to serve attacks embedded in HTTP response traffic — Enable HTTP response processing for inbound traffic only.
You want to protect both internal clients as well as the Web content you are serving to external clients — Enable HTTP response processing in both directions.