Firewall v/s IPS

Unanswered Question
Sep 22nd, 2008

Hi, During these days I am trying to understand IPS and IDS concepts. I just want to know how is different an IPS device from Firewall in the terms of traffic blocking as I know we can handle the traffic on ASA FW by using MPF then why we require IPS. Thanks

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mhellman Wed, 09/24/2008 - 05:40

The [firewall and IPS] products are converging, but generally an IPS is better at deep packet inspection and a firewall is better at pretty much everything else (they've been around a long time and are more mature).

Specifically to the ASA, an ASA without the AIP-SSM (the IPS module) has deep packet inspection capabilities, but doesn't have thousands of built-in signatures, with new ones added as new vulnerabilities surface. It doesn't by default protect you from most application layer attacks.

For example, here's how you can configure the ASA to defend against the "Microsoft Snapshot Viewer ActiveX Control Arbitrary File Upload Vulnerability".

http://tools.cisco.com/security/center/viewAlert.x?alertId=16224

Unless you manually do this, you won't have protection. If you have the IPS module, a signature update was released the same day and you're automatically protected:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=6968&signatureSubId=0&softwareVersion=6.0&releaseVersion=S343

Actions

This Discussion