2

Why do we need IDS/IPS if a firewall is present?

4
  • Because unless you're the Great Firewall of China, chances are packets are still going to sneak past your rules.
    – RoraΖ
    Oct 13, 2014 at 19:51
  • 5
    Three words, one concept. Defense in depth.
    – Xander
    Oct 13, 2014 at 19:55
  • 1
    Why do we need airbags if we already have seat belts? Oct 13, 2014 at 20:57
  • 3
    I think the word "need" is too strong. IDPS applications are pointless if you don't or can't invest the time into understanding them and responding to the alerts they provide. There are a dozen different ways to mitigate risk and each business must balance this with other priorities. I've seen people being sold fancy IDPS solutions whether some staff training and regular backups would have been much better. Oct 14, 2014 at 3:05

3 Answers 3

9

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription.

Firewalls serve to control the inbound/outbound connections into an environment based on static rules (Stateful Firewalls). Your more advanced firewalls can work up at the application level (Application Firewalls), which is why at some companies you can browse FB, but not play any of its games.

IPS/IDS serve to monitor connections for malicious activities mainly through signature based detection (similar to AV). Attacks have certain patterns and depending on your setup you can be alerted or have the system take action on those patterns.

You can generalize it, I suppose, to firewalls limit the types of connections you will allow into the network based on static rules, and IPS/IDS monitor those connections for malicious activity based on signatures and understanding of attacks.

As CoverosGene and Xander said, it part of using Defense in Depths, but technically they're two different services that tend to operate in tandem.

2

Firewall, IDS and IPS are not the same creatures. And as stated, defense in depth is the thing you're looking to provide.

A Firewall is a control mechanism used to restrict the protocols traversing between two networks at layers 3 and 4 - that is its primary function (See Shane's answer). In some instances, the firewall can perform limited inspection of layers 5, 6 and 7. But in those cases, it's simply attempting to do double duty - which it may not perform well because firewalls don't have the processing muscle to do protocol analysis. In the end, you can think of a firewall as a tool to control protocols.

An IDS is not a control mechanism. It has much more processing power than a typical firewall, but generally less throughput since it is performing much more work. An IDS can detect intrusions but it cannot control them. It cannot function as a firewall and it cannot function as an IPS. An IDS can perform detection in layers 2 through 7.

An IPS is a control mechanism - it is an "Intrusion Prevention System." It is an IDS with the ability to control frames and packets in layers 2 through 7. Again, it has much more processing power than a Firewall, but generally less throughput due to the inspection it must perform. An IPS may have the ability to perform many Firewall-like functions, but the IPS is generally more difficult to administer when deployed for that function since it's designed to detect exploits and prevent attacks, not act like a firewall.

A typical deployment might look like this:

internet <-> firewall <-> IPS <-> DMZ <-> Firewall <-> IPS <-> corporate network

0

Defense in depth

Presumably, your firewall will be letting some traffic in and out. Otherwise, just disconnect from the network and you'll have a lot less to worry about.

Once traffic comes in to your network past the firewall, it would be prudent to be keeping an eye on it to make sure it isn't malicious.

Unless your firewall rules are perfect, you are going to let something in that you didn't intend or, more likely, didn't anticipate. Scratch that, even with perfect firewall rules you would need to have perfect inside users as well.

Trust, but verify. Trust that your firewall is keeping you safe. But verify that it is keeping you safe.

1
  • More specifically, the firewall will correctly allow your users to browse websites. The IPS will inspect the traffic and has a chance at blocking XSS attacks inside. Valid source and destination doesn't guarantee safety.
    – Jeff K
    Feb 24, 2017 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.