Cisco IPS Devices - Outside & Inside Network

[dchristm09]

For around 300 users what is recommended for Cisco IPS?  I was thinking of two devices, one on the outside of the network and one on the inside.

Thanks,

Dave

[Karsten Iwen]

Just ask yourself if the output of an outside sensor is of any value to you. Most of the times it is not and the money is better invested in other things (for example an IPS-training as IPS is a quite complex technologie).

The number of users don't play any role as longs as they are so small numbers as 300. More importand is the bandwidth that you want to protect. For that you need to decide if you only want to monitor the traffic to and from the internet (probably lower bandwidth) or if you also want to monitor your internal traffic (probably higher bandwidth). For inline mode you have to decide how you want to assure the network-availability (the sensor has to restart from time to time and also could fail).

Then you can implement IPS as an standalone appliance and integrated into your ASA or your IOS perimeter-router (if you have one of these).

So, tell us more about your environment and you get more recommendations for you setup.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[dchristm09]

Our environment uses a Cisco router for the internet router with a IPS device (3rd party) inside that then an ASA 5510 for our internet firewall which has IPS on it as well.  We then have another IPS device (3rd party) inside the ASA to monitor internal traffic.  The IPS devices are set inline.  We're looking at pricing as the cost is a lot per year and would it be better to look at Cisco IPS.  I just assumed a device on the outside and inside would be better but not sure of other options.