By deploying IPS, organizations are able to identify, classify, and stop malicious traffic, including worms, spyware / adware, network viruses, and application abuse before they affect business continuity.
Internet Border & DMZThe most common place to insert IPS is at an organizations' internet border(s) and DMZ(s). The following represents some of the options for placement of an IPS to protect an internet border and DMZ.
IPS Outside of FirewallThis architecture places the IPS outside of the internet firewall.This architecture was one of the first proposed when IPS came to market, but is not very common for today's environments.
Pros:
- Early indication of reconnaissance/scanning activities
- Requires less interfaces to inspect traffic sourced/destined to the DMZ and Internal Network
Cons:
- Destination/Victims addresses will be NATed, causing research to determine which device inside the organization is being attacked.
- Source/Attacker addresses from the inside of the organization will be NATed causing additional research to track down the source of any malicious traffic coming from the organization.
- Inspection of traffic that will be dropped by the firewall will create excess false positives.
- No visibility of insider traffic destined to dmz
 |
| Figure 1 - IPS Placed Outside of the Firewall |
IPS Inside of Firewall for DMZ and Internal NetworkThis architecture places the IPS inside of the internet firewall protecting both the Internal Network and DMZ segments.
Pros:
- Only inspects traffic that the firewall allows into the network. (Minimizing False Positives)
- Events will include real IP addresses and not NATed IPs.
- Differentiate traffic to/from DMZ and Internal Segments.
Cons:
- Requires 2 IPSs or an IPS with enough interfaces to protect both segments.
- Traffic between internal and DMZ will be inspected twice.
 |
| Figure 2 - IPS Placed Inside the Firewall |
IPS Software or Module in the Firewall
With the growing popularity of Unified Threat Management (UTM), this architecture is becoming extremely common. It places the IPS functionality inside the internet firewall protecting both the Internal Network and DMZ segments without a separate appliance.
Pros:
- No additional appliance required, saving rack space and energy.
- Events will include real IP addresses and not NATed IPs.
- Differentiate traffic to/from DMZ and Internal Segments.
Cons:
- Some manufacturers limit the throughput of integrated IPS (just be sure that the integrated IPS will support the required bandwidth)
 |
| Figure 3 - IPS Software or Module in the Firewall |
