Re: Re: Firewall and IPS Deployment

[praveen_recker () sify com]

The flow for IDS should look like

Internetwork---->Firewall---->IDS

Firewall is used to block IP Addresses, Ports etc. 

IDS/IPS on the other hand brings granularity. Suppose you are maintaining a web server then you'll allow data on port 
80. Some malilicious user sends attack towards ur web-server. Firewall will allow that data but IDS will and raise an 
alarm if respective Signature exists and in the case of IPS it might even RESET the session based upon the Signature.

If you put the IDS infront of the firewall the it has to analyse all the data (from port 0 to 65535)which is real 
wastage and IDS/IPS might not have good performance. IT IS ALWAYS PREFERABLE TO USE IDS/IPS AFTER FIREWALL.

Praveen Darshanam,
Security Researcher,
INDIA