AN IPS is basically deep packet inspection for all protocols generally found on a network. So, for example an IPS is looking for all malicious traffic that relates to an attack, usually by a specific 'signature' or a pattern of traffic. They go over an above a firewall by fully inspecting all traffic flows and alerting on suspect traffic that represents a possible attack/vulnerability.
With respect to an Application Firewall, this could relate to two different things. For example, the ASA has application inspection which basically means it can drill down into the protocol and check that HTTP request/response headers are RFC compliant, as well as FTP etc. We can also drill down and ensure that SMTP exchanges are as they should be. But if there is data embedded into the actual 'payload' then the ASA is not designed to check for this. That would be an IPS.
There is however a 'Web Application Firewall' or WAF which takes this even further (ACE WAF) as this is specifically looking for attacks and vulnerabilities relating purely to Web Applications. So the 'WAF' learns the web application/login forms/Parameters etc and therefore can stop attacks such as Cross Site Scripting and SQL Injection.
It depends on the environment and what you are exactly trying to secure :-)
In a way, yes. Take viruses as an example and the test file 'EICAR'. If you download this file natively through an ASA it will allow it through as the connection that you have created is legitimate from the web site. However, the virus test file is embedded within the payload and so only an IPS would pick this up.
You can write rules on the ASA (and using NBAR on IOS routers) using regular expressions that can stop some attacks (code red and nimda are examples), but obviously this is not intended to scale as it is impossible for an administrator to write for everything, you need an IPS.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...