Just ask yourself if the output of an outside sensor is of any value to you. Most of the times it is not and the money is better invested in other things (for example an IPS-training as IPS is a quite complex technologie).
The number of users don't play any role as longs as they are so small numbers as 300. More importand is the bandwidth that you want to protect. For that you need to decide if you only want to monitor the traffic to and from the internet (probably lower bandwidth) or if you also want to monitor your internal traffic (probably higher bandwidth). For inline mode you have to decide how you want to assure the network-availability (the sensor has to restart from time to time and also could fail).
Then you can implement IPS as an standalone appliance and integrated into your ASA or your IOS perimeter-router (if you have one of these).
So, tell us more about your environment and you get more recommendations for you setup.
Our environment uses a Cisco router for the internet router with a IPS device (3rd party) inside that then an ASA 5510 for our internet firewall which has IPS on it as well. We then have another IPS device (3rd party) inside the ASA to monitor internal traffic. The IPS devices are set inline. We're looking at pricing as the cost is a lot per year and would it be better to look at Cisco IPS. I just assumed a device on the outside and inside would be better but not sure of other options.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...