Just ask yourself if the output of an outside sensor is of any value to you. Most of the times it is not and the money is better invested in other things (for example an IPS-training as IPS is a quite complex technologie).
The number of users don't play any role as longs as they are so small numbers as 300. More importand is the bandwidth that you want to protect. For that you need to decide if you only want to monitor the traffic to and from the internet (probably lower bandwidth) or if you also want to monitor your internal traffic (probably higher bandwidth). For inline mode you have to decide how you want to assure the network-availability (the sensor has to restart from time to time and also could fail).
Then you can implement IPS as an standalone appliance and integrated into your ASA or your IOS perimeter-router (if you have one of these).
So, tell us more about your environment and you get more recommendations for you setup.
Our environment uses a Cisco router for the internet router with a IPS device (3rd party) inside that then an ASA 5510 for our internet firewall which has IPS on it as well. We then have another IPS device (3rd party) inside the ASA to monitor internal traffic. The IPS devices are set inline. We're looking at pricing as the cost is a lot per year and would it be better to look at Cisco IPS. I just assumed a device on the outside and inside would be better but not sure of other options.
Hi Team, I have one exclusion provided by internal team which is Is it right way to exclude ? *\Program Files\XYZ\* , as per Cisco Docs i see its not recommended because it will create performance issue when we use * at starting , So...
Central Log Management using Cisco Security Analytics and Logging, December 2nd at 8am-9:30am PT
Cisco Security Analytics and Logging is Cisco’s Central Log Management solution for Network Operations and Security Outcomes. It is delivered both as a c...
Cyberattacks are more sophisticated than ever and your online presence has never been more critical to the success of your business. Cisco, through its OEM partnership with Radware, can help secure your digital future by continuously monitoring...
We have a filter that blocks incoming messages with credit card numbers. But it won't pick up on messages with 4 digit blocks on separate lines. Example:1234567890123456 Any suggestion on how to detect this pattern?