where is it best to apply IPS

carl_townshend · ‎03-25-2015

Hi All

Can anyone tell me where it is most critical to apply IPS inspection

inside to internet?

internet to inside?

inside to WAN ?

We have a firewall that has lots of connections and we may have to switch IPS off on certain traffic due to the load, so I would like to know what part is most critical to run IPS and why?

cheers

chenbs · ‎03-25-2015

Hi,

It would be good to apply internet to inside as the connections from inside to outside & inside

to WAN are classified from source addresses. From the internet, the threats are generally higher

as vulnerabilities in your internal network is unknown, it could be subject to reconissance attacks etc..

Running a firewall as well as IPS cuts down throughput as most firewalls check the packet for source/destination/port against an ACL and then forwards it to the IPS inspection engine. You might want to consider a dedicated IPS appliance.