What is the difference between IPS Intrusion Protection System and network firewall, and what is the location of IPS deployment in the network in general?

One is the deployment of different locations

1. Firewalls are generally deployed for the outreach exit or regional exit location, the internal and external traffic security isolation.

2. IPS is usually strung on the trunk road, the internal and external network abnormal traffic monitoring and processing.

Second, the protection content is different

1. Firewalls are mainly applied to forwarding, intranet protection (NAT), flow control, and filtering. In the OSI network hierarchy model, firewalls mainly play a protective role in layers 2-4.

2. IPS is mainly for some attack situations, can do 5-7 layers of application protection.

Third, the working mechanism is different

1. Firewall is an important network boundary control settings, mainly through the policy five elements (source, destination, event, protocol and action) to achieve access control on the network.

2. IPS proactively sense and prevent attack events or abnormal behavior in advance.

IPS is generally deployed in the following positions in the network:

One is the internal access layer of the office network;

The second is the connection between the office network and the external network, or the production network and the office network, etc. (exit and entrance);

The third is the front of the important server cluster.