topic Thanks Jeremy, very helpful in Network Security

Placement of IDS & IPS, Inside or Outside?

Mokhalil82 — Sun, 10 Mar 2019 13:21:44 GMT

I have a IDS and IPS, now deciding on where these should be placed. IDS inside and IPS outside the firewall or vice versa. Ive read various pros and cons but would like to get some advice from people who have any placement experience.

Thanks

Hello,What products are you

ArchiTech89 — Mon, 20 Apr 2015 16:07:05 GMT

Hello,

What products are you talking about? Do you have Cisco's ASAs (Adaptive Security Appliances)?

HiSorry should have mentioned

Mokhalil82 — Mon, 20 Apr 2015 16:30:09 GMT

Sorry should have mentioned, it's Cisco ASA's

The ASA is a firewall and has

ArchiTech89 — Mon, 20 Apr 2015 18:41:22 GMT

The ASA is a firewall that has the IDS/IPS functionality in addition to other things -- hence a "security appliance."

As a firewall, the ASA device is placed on the network edge, that is, likely as the first device inside the WAN connection (bridge, modem), though sometimes it makes sense to have a router on the outside especially if there are multiple connections to ISPs for redundancy, load balancing, or Quality of Service implementations.

What model of ASA are we talking about?

IDS/IPS functionality occurs inside the device -- there's a "module" that's internal to the device that handles the duties. In the case of IPS, it will prevent malicious traffic from entering your organization's network (the often-called inside network). In the case of IDS, it will just flag the traffic and issue a warning through whatever means have been configured. These correspond loosely to inline mode and promiscuous mode respectively.

I'm no expert, but I hope I've been able to help answer your original question...

jeremyNLSO
Berlin, Germany

Thanks Jeremy, very helpful

Mokhalil82 — Tue, 21 Apr 2015 20:53:28 GMT

Thanks Jeremy, very helpful