This question already has an answer here:

I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?

marked as duplicate by NULLZ, Ayrx, Adi, TildalWave, Rory Alsop May 27 '13 at 12:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • To put it simply: put it between any two network zones that have differing trust levels. Which two zones you choose is up to you, and usually depends on your network. If you've got a flat unsegregated internal network, then your only trust level change is between your network and the internet. – Polynomial May 27 '13 at 8:45

It depends on what you want to do

  • If you want to see what threats are being aimed at your from the internet. You can put the IDS outside the firewall (assuming you've hardened it appropriately) and behind the router.

  • If you want to see what potentially malicious internal traffic you have inside your perimeter then monitoring from a point between the firewall and internal LAN is more appropriate.

Consider what traffic you want to examine, the find the relevant point in your network that the traffic HAS to flow through to get there. Since Snort is a free IDS and hardware is fairly cheap, it may be possible for you to invest in more than one IDS.

I'd also recommend the following read from SANS about configuring and placing IDS's

  • I think I should be asking then, in terms of protecting the confidentiality, integrity, and availability of the network, is it more valuable to monitor for threats from the outside, or inside? – sybind May 30 '13 at 2:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.