There is a feature that enables both IPS and Application Control on both non-HTTP WANOpt traffic and HTTP-tunneled traffic through HTTP CONNECT. The basic idea is that it hooks a scan connection to a port so that traffic will be redirected to the IPS engine before forwarding to a different module.