I was reading the article "Do you need an IDS or IPS, or both?" on TechTarget. While reading the author's explanation of IPS this question hit me.

If an IPS is a control tool that uses a set of rules for blocking/allowing traffic and a router can route and NAT and implement ACLs, then what is a firewall good for?

  • There is a large overlap in functions, the way you describe it. If your IPS provides all the functionality a firewall would traditionally provide, then of course a firewall is unnecessary... – Luc Mar 22 '18 at 12:13
  • Possible duplicate of Question about IDS and IPS – Tom K. Mar 22 '18 at 12:21

The terms "Firewall" and "IPS" do not describe specific technical implementations and capabilities. While traditionally the term "Firewall" is mostly used to describe a stateless and then later a stateful packet filter (like Checkpoint Firewall-1) they are also used to describe proxy based technologies (like the FWTK - firewall toolkit). And what was formerly was called IPS is today (more or less enhanced) marketed as Next Generation Firewall (NGFW). Note that the article you refer to seems to be from 2009 when the term NGFW was still uncommon.

If you look at the underlying technologies: a traditional IPS was commonly implemented with deep packet inspection (DPI) but additionally a packet filter was used (i.e. one of the traditional meanings of the term "firewall") to reduce load on the DPI in that obviously unwanted or wanted connections were handled by the packet filter firewall in a cheap way instead of dealing with these in the way more resource-hungry and slower DPI.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.