Physical IPS vs IPS Module

[learnsec]

hello,

Do u think, from a security expert perspective, replacing a physical IPS with an IPS module on the Firewall will have any beneficiary?

any idea that may clarify?

[turnera]

Throughput will be your biggest expense. The physical IPS box will, more than likely, allow faster throughput speeds. Whereas an IPS module will have reduced throughput speeds. In addition, you will be limited in your virtual sensors, typically the modules will have one. If you need more, you will be forced to look at stand alone IPS/IDS devices.

If you have a small network where speed and virtual sensors are not a problem, then the module will more than likely work. If you are in a larger scale enviornment, then you will need to look at stand alone devices as your solution.

[learnsec]

thanks tunera,

just 2 small questions:

- can i install IPS module on a router? or it is only for Firewalls

- i see some network designs where they put a switch before the IPS and a switch after, to do not connect the IPS to the router directly or the firewall. is that a common design or best practise ? or is there any best practise design?

[turnera · Accepted solution]

Yes you can install IPS modules into routers. Take a look at the following presentation to get an idea what range of devices are available to you.

http://www.cisco.com/en/US/prod/collateral/routers/ps5853/ps5875/prod_presentation0900aecd806ccf26.pdf

As for your second question, neither implementation is strictly right or wrong. Situation will dictate what you want to do regarding how you configure the path to the ISP. My personal preference would be to put a switch between the IPS and the router and configure it accordingly. It provides me some flexibility that can allow me to plug in other devices into the network path if I find I need to.