03-24-2009 01:43 AM - edited 03-10-2019 04:33 AM
Hi all, can anyone explain to me what an IPS does that a layer 7 application firewall does not, i need to know the biggest differences?
also what can an IPS do for me in simple terms?
03-24-2009 08:27 AM
Hi Carl,
AN IPS is basically deep packet inspection for all protocols generally found on a network. So, for example an IPS is looking for all malicious traffic that relates to an attack, usually by a specific 'signature' or a pattern of traffic. They go over an above a firewall by fully inspecting all traffic flows and alerting on suspect traffic that represents a possible attack/vulnerability.
With respect to an Application Firewall, this could relate to two different things. For example, the ASA has application inspection which basically means it can drill down into the protocol and check that HTTP request/response headers are RFC compliant, as well as FTP etc. We can also drill down and ensure that SMTP exchanges are as they should be. But if there is data embedded into the actual 'payload' then the ASA is not designed to check for this. That would be an IPS.
There is however a 'Web Application Firewall' or WAF which takes this even further (ACE WAF) as this is specifically looking for attacks and vulnerabilities relating purely to Web Applications. So the 'WAF' learns the web application/login forms/Parameters etc and therefore can stop attacks such as Cross Site Scripting and SQL Injection.
It depends on the environment and what you are exactly trying to secure :-)
I hope this helps!
Thanks
Andy
03-25-2009 03:19 AM
Hi there, so
am i correct in saying the IPS checks the payload and headers?
and the ASA only checks the headers of packets ?
cheers
Carl
03-25-2009 07:33 AM
Hi Carl,
In a way, yes. Take viruses as an example and the test file 'EICAR'. If you download this file natively through an ASA it will allow it through as the connection that you have created is legitimate from the web site. However, the virus test file is embedded within the payload and so only an IPS would pick this up.
You can write rules on the ASA (and using NBAR on IOS routers) using regular expressions that can stop some attacks (code red and nimda are examples), but obviously this is not intended to scale as it is impossible for an administrator to write for everything, you need an IPS.
Hope this helps,
Andy
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide