topic Physical IPS vs IPS Module in Network Security

Physical IPS vs IPS Module

learnsec — Sun, 10 Mar 2019 12:49:03 GMT

hello,

Do u think, from a security expert perspective, replacing a physical IPS with an IPS module on the Firewall will have any beneficiary?

any idea that may clarify?

Physical IPS vs IPS Module

turnera — Fri, 09 Nov 2012 18:46:45 GMT

Throughput will be your biggest expense. The physical IPS box will, more than likely, allow faster throughput speeds. Whereas an IPS module will have reduced throughput speeds. In addition, you will be limited in your virtual sensors, typically the modules will have one. If you need more, you will be forced to look at stand alone IPS/IDS devices.

If you have a small network where speed and virtual sensors are not a problem, then the module will more than likely work. If you are in a larger scale enviornment, then you will need to look at stand alone devices as your solution.

Physical IPS vs IPS Module

learnsec — Sat, 10 Nov 2012 05:40:02 GMT

thanks tunera,

just 2 small questions:

- can i install IPS module on a router? or it is only for Firewalls

- i see some network designs where they put a switch before the IPS and a switch after, to do not connect the IPS to the router directly or the firewall. is that a common design or best practise ? or is there any best practise design?

Physical IPS vs IPS Module

turnera — Sat, 10 Nov 2012 19:24:06 GMT

Yes you can install IPS modules into routers. Take a look at the following presentation to get an idea what range of devices are available to you.

http://www.cisco.com/en/US/prod/collateral/routers/ps5853/ps5875/prod_presentation0900aecd806ccf26.pdf

As for your second question, neither implementation is strictly right or wrong. Situation will dictate what you want to do regarding how you configure the path to the ISP. My personal preference would be to put a switch between the IPS and the router and configure it accordingly. It provides me some flexibility that can allow me to plug in other devices into the network path if I find I need to.