What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?

  • External vs DMZ vs internal. Internal should be in a place where it is connected with the largest amount of internal networks. – bradbury9 Sep 28 '18 at 7:03

The answer is: it depends.

If you need to see all the crap hitting you from the Internet, IDS should be outside the firewall. Although it is not recommended because you literally get flooded with useless data and gives the machine lots of load. If not, just put it in.

IPS should be inside the firewall because it consumes more time per packet to inspect than the firewall.

  • if attack is happening on the network, it will detect in early phase and notify technical team to take decisions, then it will be helpful right? – Sun-IT Sep 28 '18 at 7:47
  • @Sun-IT It can also be done by a firewall. – user186505 Sep 28 '18 at 9:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.