IPS and application layer firewalls

carl_townshend · ‎03-24-2009

Hi all, can anyone explain to me what an IPS does that a layer 7 application firewall does not, i need to know the biggest differences?

also what can an IPS do for me in simple terms?

andrew100 · ‎03-24-2009

Hi Carl,

AN IPS is basically deep packet inspection for all protocols generally found on a network. So, for example an IPS is looking for all malicious traffic that relates to an attack, usually by a specific 'signature' or a pattern of traffic. They go over an above a firewall by fully inspecting all traffic flows and alerting on suspect traffic that represents a possible attack/vulnerability.

With respect to an Application Firewall, this could relate to two different things. For example, the ASA has application inspection which basically means it can drill down into the protocol and check that HTTP request/response headers are RFC compliant, as well as FTP etc. We can also drill down and ensure that SMTP exchanges are as they should be. But if there is data embedded into the actual 'payload' then the ASA is not designed to check for this. That would be an IPS.

There is however a 'Web Application Firewall' or WAF which takes this even further (ACE WAF) as this is specifically looking for attacks and vulnerabilities relating purely to Web Applications. So the 'WAF' learns the web application/login forms/Parameters etc and therefore can stop attacks such as Cross Site Scripting and SQL Injection.

It depends on the environment and what you are exactly trying to secure :-)

I hope this helps!

Thanks

Andy

carl_townshend · ‎03-25-2009

Hi there, so

am i correct in saying the IPS checks the payload and headers?

and the ASA only checks the headers of packets ?

cheers

Carl

andrew100 · ‎03-25-2009

Hi Carl,

In a way, yes. Take viruses as an example and the test file 'EICAR'. If you download this file natively through an ASA it will allow it through as the connection that you have created is legitimate from the web site. However, the virus test file is embedded within the payload and so only an IPS would pick this up.

You can write rules on the ASA (and using NBAR on IOS routers) using regular expressions that can stop some attacks (code red and nimda are examples), but obviously this is not intended to scale as it is impossible for an administrator to write for everything, you need an IPS.

Hope this helps,

Andy