SCAT connection between BRAS and NAT. You can use additional services using this connection. If you need traffic filtering only: you can connect after NAT/ edge router in the uplink break.
Device installation manual

The typical connection diagram if bypass functionality is available:

The connection diagram without bypass functionality:

The connection diagram for several SCATs "symmetric hash" to process more than 20GbE: Juniper symmetric hash configuration details
CISCO configuration details

Note the modification in the above diagram using VLAN (Dispatch mode):
The subscriber's traffic comes to the first port of the switch. Then it goes to the second switch port and is received by DPI. Further, the processed by DPI traffic enters the third port of the switch and leaves to Internet via the fourth port. To support such operation, one can arrange the connections like this: the first two ports of the switch form the first VLAN and other two ports form the second VLAN. The traffic would be sent to DPI on L2 level.

The diagram above has an item:Figure 5 Layer 2 Dispatch Mode
One can configure the system in a similar way, but without port-channel: to use one port everywhere.
Note that the manual uses a trunk with VLAN specification. In case you do not use a trunk please set ports into access mode.

The asymmetric traffic processing method based on policy based routing. It is applicable for filtering only and we do not recommend it.

The asymmetric diagram with BGP/32 routes announcing. Applications:

redirection of queries to support blocking and notifications;

bonus program;

caching.

BGP/32 routes are configured by the operator.

The mirrored traffic based diagram. Applications:

to get real time click stream via ipfix;

redirection of queries to support blocking and notifications;

bonus program;

caching;

SORM pre-filter.

The diagram with a mirrored traffic via SPAN ports to support SORM pre-filter.