Why do we need IDS/IPS if a firewall is present?

Question

Why do we need IDS/IPS if a firewall is present?

Answer 1

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription.

Firewalls serve to control the inbound/outbound connections into an environment based on static rules (Stateful Firewalls). Your more advanced firewalls can work up at the application level (Application Firewalls), which is why at some companies you can browse FB, but not play any of its games.

IPS/IDS serve to monitor connections for malicious activities mainly through signature based detection (similar to AV). Attacks have certain patterns and depending on your setup you can be alerted or have the system take action on those patterns.

You can generalize it, I suppose, to firewalls limit the types of connections you will allow into the network based on static rules, and IPS/IDS monitor those connections for malicious activity based on signatures and understanding of attacks.

As CoverosGene and Xander said, it part of using Defense in Depths, but technically they're two different services that tend to operate in tandem.

Answer 2

Firewall, IDS and IPS are not the same creatures. And as stated, defense in depth is the thing you're looking to provide.

A Firewall is a control mechanism used to restrict the protocols traversing between two networks at layers 3 and 4 - that is its primary function (See Shane's answer). In some instances, the firewall can perform limited inspection of layers 5, 6 and 7. But in those cases, it's simply attempting to do double duty - which it may not perform well because firewalls don't have the processing muscle to do protocol analysis. In the end, you can think of a firewall as a tool to control protocols.

An IDS is not a control mechanism. It has much more processing power than a typical firewall, but generally less throughput since it is performing much more work. An IDS can detect intrusions but it cannot control them. It cannot function as a firewall and it cannot function as an IPS. An IDS can perform detection in layers 2 through 7.

An IPS is a control mechanism - it is an "Intrusion Prevention System." It is an IDS with the ability to control frames and packets in layers 2 through 7. Again, it has much more processing power than a Firewall, but generally less throughput due to the inspection it must perform. An IPS may have the ability to perform many Firewall-like functions, but the IPS is generally more difficult to administer when deployed for that function since it's designed to detect exploits and prevent attacks, not act like a firewall.

A typical deployment might look like this:

internet <-> firewall <-> IPS <-> DMZ <-> Firewall <-> IPS <-> corporate network

Answer 3

Defense in depth

Presumably, your firewall will be letting some traffic in and out. Otherwise, just disconnect from the network and you'll have a lot less to worry about.

Once traffic comes in to your network past the firewall, it would be prudent to be keeping an eye on it to make sure it isn't malicious.

Unless your firewall rules are perfect, you are going to let something in that you didn't intend or, more likely, didn't anticipate. Scratch that, even with perfect firewall rules you would need to have perfect inside users as well.

Trust, but verify. Trust that your firewall is keeping you safe. But verify that it is keeping you safe.