Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Firewall v/s IPS

Hi, During these days I am trying to understand IPS and IDS concepts. I just want to know how is different an IPS device from Firewall in the terms of traffic blocking as I know we can handle the traffic on ASA FW by using MPF then why we require IPS. Thanks

1 REPLY
Gold

Re: Firewall v/s IPS

The [firewall and IPS] products are converging, but generally an IPS is better at deep packet inspection and a firewall is better at pretty much everything else (they've been around a long time and are more mature).

Specifically to the ASA, an ASA without the AIP-SSM (the IPS module) has deep packet inspection capabilities, but doesn't have thousands of built-in signatures, with new ones added as new vulnerabilities surface. It doesn't by default protect you from most application layer attacks.

For example, here's how you can configure the ASA to defend against the "Microsoft Snapshot Viewer ActiveX Control Arbitrary File Upload Vulnerability".

http://tools.cisco.com/security/center/viewAlert.x?alertId=16224

Unless you manually do this, you won't have protection. If you have the IPS module, a signature update was released the same day and you're automatically protected:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=6968&signatureSubId=0&softwareVersion=6.0&releaseVersion=S343

116
Views
0
Helpful
1
Replies