Firewall v/s IPS

ray_stone — Sun, 10 Mar 2019 11:18:17 GMT

Hi, During these days I am trying to understand IPS and IDS concepts. I just want to know how is different an IPS device from Firewall in the terms of traffic blocking as I know we can handle the traffic on ASA FW by using MPF then why we require IPS. Thanks

Re: Firewall v/s IPS

mhellman — Wed, 24 Sep 2008 12:40:43 GMT

The [firewall and IPS] products are converging, but generally an IPS is better at deep packet inspection and a firewall is better at pretty much everything else (they've been around a long time and are more mature).

Specifically to the ASA, an ASA without the AIP-SSM (the IPS module) has deep packet inspection capabilities, but doesn't have thousands of built-in signatures, with new ones added as new vulnerabilities surface. It doesn't by default protect you from most application layer attacks.

For example, here's how you can configure the ASA to defend against the "Microsoft Snapshot Viewer ActiveX Control Arbitrary File Upload Vulnerability".

http://tools.cisco.com/security/center/viewAlert.x?alertId=16224

Unless you manually do this, you won't have protection. If you have the IPS module, a signature update was released the same day and you're automatically protected:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=6968&signatureSubId=0&softwareVersion=6.0&releaseVersion=S343

topic Firewall v/s IPS in Network Security

Firewall v/s IPS

Re: Firewall v/s IPS