topic Re: IPS and IDS Solution in Network Security

IPS and IDS Solution

anton_vasanth — Fri, 21 Feb 2020 15:09:44 GMT

Hi,

I'm looking for an IPS and IDS solution to protect my my medium sized company's network. Can anyone please recommend the best IPS and IDS solution for my company?

Thanks

Anton

Re: IPS and IDS Solution

Marvin Rhoads — Thu, 18 Jan 2018 15:12:34 GMT

Posting that question on the Cisco Support Community kind of leads you to a Cisco product. 🙂

Which one depends a lot on your existing security products and the amount of throughput your require.

Re: IPS and IDS Solution

anton_vasanth — Thu, 18 Jan 2018 16:07:19 GMT

Hi Marvin,

Thanks for your reply.

Yes I'm looking cisco IPS/IDS product.

Currently I'm running IP/IDS on asa firewall itself. I'm looking for a centralized IPS/IDS solution for our company as we have few branches in different cities.

Thanks

Re: IPS and IDS Solution

Marvin Rhoads — Thu, 18 Jan 2018 16:19:52 GMT

Does all the traffic go through a single firewall at Hqs for Internet access or does each branch have direct Internet access?

Which IPS type are you currently running and on what hardware model? Firepower is the current generation and it offers centralized management of policy, devices and logs via the Firepower Management Center product.

Re: IPS and IDS Solution

anton_vasanth — Fri, 19 Jan 2018 16:25:37 GMT

Hi Marvin,

Each branch has its own direct internet access.

We're running firepower on every branch's cisco asa 5516 firewall.

Thanks

Re: IPS and IDS Solution

Marvin Rhoads — Fri, 19 Jan 2018 17:27:31 GMT

As long as each branch has direct Internet access and an ASA with Firepower services, there's always going to be distributed IPS functionality.

You should be using Firepower Management Center (FMC) to centrally manage all of the policies and gather all of the connection events.

Re: IPS and IDS Solution

anton_vasanth — Tue, 23 Jan 2018 10:34:06 GMT

Thanks Mervin.

Can you run Firepower Management Center (FMC) on the cloud?

Thanks

Re: IPS and IDS Solution

Marvin Rhoads — Tue, 23 Jan 2018 13:19:25 GMT

FMC can run in the cloud. It's supported natively in AWS:

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#reference_7CC9392196754AD38B5250A9183027C8

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/aws/fmcv-aws-qsg.html

It's not supported on other cloud providers' platforms like Microsoft's Azure or Google's GCP.

Re: IPS and IDS Solution

anton_vasanth — Tue, 23 Jan 2018 13:53:06 GMT

Thanks Marvin!

Re: IPS and IDS Solution

Marvin Rhoads — Tue, 23 Jan 2018 14:07:19 GMT

You're welcome.

Please give a helpful rating or mark your question as answered if it has been.

Re: IPS and IDS Solution

anton_vasanth — Mon, 05 Feb 2018 14:49:02 GMT

Hi Marvin,

Just a quick question.

I have Protection, Control, URL Filtering licenses on all our branch office ASA. So, I'm planing to deploy a Firepower Management Center to centrally manage them, in order to do that,

Do I still need a separate licenses for those features to be activated in FMC?

Do I still need a separate license for FMC?

Thanks

Re: IPS and IDS Solution

Marvin Rhoads — Mon, 05 Feb 2018 14:56:09 GMT

When you manage classic licenses (such as are used by ASA Firepower modules) you install the license keys on FMC itself. If you had previously been using ASDM, you will need to rehost those licenses to FMC.

FMC itself is a licensed product. The VM form factor can be purchased with license to manage either 2, 10 or unlimited (in reality up to 25 maximum) sensors (remote devices).

Re: IPS and IDS Solution

anton_vasanth — Mon, 05 Feb 2018 15:10:59 GMT

Thanks for your quick reply.