Re: IPS Reliability/Availability

[FinAckSyn <finacksyn () yahoo co uk>]

Hi Mike,

The first question you must ask yourself is whether or
not you are prepared to put a PC-based solution inline
in your network?
So bypass switches may solve reliability issues, but
why bother going to all that trouble with bypass
switches and load balanced clusters when there are
some excellent dedicated, ASIC-based IPS solutions
available.  TippingPoint, McAfee and TopLayer are the
biggest players in this space, and should be on any
shortlist.
As for real world experience, I have never had ANY
reliability or performance issues with TopLayer, whom
even go one step further as to include separate
management and event logging processors to ensure that
GUI access, SYSLOG/SNMP functions are 100% available
no matter what the network load.
If you're in a core network, be very careful with
signature based products.  TippingPoint and McAfee are
heavily reliant on Snort signatures, which although
may do a good job on the perimeter at defending known
attacks, open a whole can of false positives when used
on internal networks.  I've had big problems tuning
both TippingPoint and McAfee devices, and felt most
uncomfortable having to disable vast portions of their
signature sets to get them running at acceptable
speeds.  This is even worse on a core network, as
you're dealing with far higher speeds.

Rgds,

Matt


--- geek_brigades () yahoo com wrote:

> I am working on a big IPS project and I am very
> concerned about installing an inline device in a
> core enterprise network, where these devices have
> the potential to create big time network outages. 
>
> Can you, please, share your possible bad experiences
> about the reliability of the following inline IPS
> products:
>
> ISS
> TippingPoint
> Juniper IPS
> Sourcefire
> McAfee IntruShield
>
> Have you had any issues with the availability of
> these devices, such as fail close crashes or do you
> have any experience with bypass switches that would
> mitigate the availability issue?
>
> Thanks,
> Mike
------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
> to learn more.
------------------------------------------------------------------------
>



                
___________________________________________________________ 
How much free photo storage do you get? Store your holiday 
snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------