IDS mailing list archives
Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)
From: "Srini" <srao () intotoinc com>
Date: Thu, 19 Aug 2004 11:24:43 -0700
As on today, even though there is quite a bit of overlap, there are some significant differences between IPS and Firewall technolgies. In future, vendors might combine both of these and call as IPS or by some other name. In my view, Firewallsdo following, which IPSes don't do normally. - Firewalls implement 'Access Control lists' , each list having set of access control rules and filtering happens based on these lists. These lists are referred only upon session establishment, not for each packet (IPS/IDS systems tend to go through all the rules for evey packet, even though some intelligence is built into IPSes to intelligently select subset of rules for searching). Firewalls today tend to stop search upon a rule match. In IPS/IDS systems, all rules are searched to ensure that there are no attack pattern associated with the packet/data. - Firewall are always 'Inline'. - Firewalls do 'NAT', 'Port forwarding' and Redirection of traffic. - Firewalls open holes by intelligently intrepreting the application data (ALGs). - Firewalls allow user/machine specific access by authenticating the users. - Firewalls can do application filtering and gracefully shutdown the connections by sending applicaiton specific errors (pages and strings). Some firewalls do this by proxying (SOCKS5, HTTP Proxy, SMTP Proxy) etc.. Srini ----- Original Message ----- From: "Jacob Winston" <jctx09 () yahoo com> To: <focus-ids () securityfocus com> Sent: Sunday, August 15, 2004 7:46 PM Subject: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)
Things are getting a little confusing. ISS claims that its Proventia boxes are also firewallas. Intrushield 2.1 has firewall/layer
4 filtering capabilities now. If the Intrushield box layer 4 acls now then what makes it not be equal to a firewall? What does a firewall do that an IPS doesn't as long as the IPS can do layer-4 access lists? Any info is apprecaited.
-------------------------------------------------------------------------- FREE Network Security Webinar - How to implement IPSec security into VPN appliances New threats and vulnerabilities require new high-performance IPSec VPN solutions for network protection. Join the security experts from SafeNet on August 26 at 1:00 PM (Eastern), and learn how to successfully integrate IPSec security
into VPN processors and appliances to provide powerful yet cost-effective VPN solutions for your customers.
Register now: http://www.securityfocus.com/sponsor/SafeNet_focus-ids_040817 --------------------------------------------------------------------------
-------------------------------------------------------------------------- FREE Network Security Webinar - How to implement IPSec security into VPN appliances New threats and vulnerabilities require new high-performance IPSec VPN solutions for network protection. Join the security experts from SafeNet on August 26 at 1:00 PM (Eastern), and learn how to successfully integrate IPSec security into VPN processors and appliances to provide powerful yet cost-effective VPN solutions for your customers. Register now: http://www.securityfocus.com/sponsor/SafeNet_focus-ids_040817 --------------------------------------------------------------------------
Current thread:
- Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Jacob Winston (Aug 18)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Ron Gula (Aug 19)
- RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Gary Halleen (Aug 19)
- RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Rob Shein (Aug 20)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) M. Dodge Mumford (Aug 20)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Shaiful (Aug 24)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) M. Dodge Mumford (Aug 20)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Srini (Aug 20)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Joel Snyder (Aug 20)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Thomas Ptacek (Aug 25)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) nick black (Aug 29)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Mike Frantzen (Aug 30)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) nick black (Aug 30)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Mike Frantzen (Aug 30)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Thomas Ptacek (Aug 25)
- Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Ron Gula (Aug 19)
- <Possible follow-ups>
- RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Fulp, J.D. USA (Aug 18)
- RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Brito, Nelson (ISS Brazil) (Aug 20)
- RE: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?) Jose Maria Lopez (Aug 30)