Which is the Preferred location of an IPS within a network? [closed]

Question

In the context of protecting a campus network, which is the Preferred location of an IPS within a network?

1. Within an ISR router
2. IPS as a separate device
3. Within ASA

Answer 1

Use google to check/translate the following blog post (in portuguese, from the author of the book Cisco Firewalls): http://alexandremspmoraes.wordpress.com/2012/07/03/multiplas-camadas-de-defesa-a-complementaridade-do-firewall-e-do-ips For me this is the best explanation I've seen on where to place IDS and IPS (and their complementarity).

Answer 2

This really depends on the network topology and size, budget, and of course, your security policies! My answer below isn't really a direct answer to your question. If you post a topology map or give further information, a more precise answer can be given. Instead I have given some guidelines on IPSs in general, that apply to various situations including the scenario I am drawing from your question.

Topology & size

If you have a large network, common places to deploy an IPS would be inside of your edge/border/transit routers on the outer border of your DMZ or border of your inner private network. You could then couple this with IDS boxes directly behind your edge/border/transit routers picking up on traffic patterns and signatures as traffic comes and, feeding info back to the IPS box(es) deeper in the network.

Border routers are good at their jobs (managing many WAN connections, or BGP peerings, uRPF, VPNs, and so on), IPS aren't good at those jobs. Don't put an IPS right at the edge because you will be inspecting all ingress/egress traffic, even when it isn't destined for your network, or only destined for the outskirts of your network!

Depending on design, some people would say in front of the DMZ for any sized network. If you have a DMZ and then a private internal network behind that, it would be good to have one in front of the DMZ and then one at the border between the DMZ and private network. This is a simple, good idea for even the smallest of networks.

Remember that the IPS is supposed to be protecting from unwanted traffic. An IDS is identifying it, logging and reporting this, and often controlling an IPS further down the line. Some IPS's do both. Integrated devices such as IPS on an ASA or ISR need to be a bit beefier, in proportion for the point in your topology it/they are deployed.

Budget

If you are talking about a single IPS box, or running integrated IPS services on an ASA or Cisco ISR G2 router, I would place this as close as possible to your pubic facing services as you can. A simple rule of thumb for cost is that the further away from your DMZ (for example) the IPS box is, the more traffic will be passing through it, as other non-DMZ-destined traffic could be passing through it, meaning you need a beefier box to process that additional unrelated traffic.

If budget is no problem and you run a large or small network, don't go crazy! IPS boxes are often a source of great headache ("Why isn't this connection from A to B on Port XYZ working?...3 hours later...Oh the 3rd IPS box in the chain is flagging and dropping it!", they are a sink hole for man hours!). Additionally as IPS's get overloaded they can introduce significant latency and jitter to traffic. Oh and in my experience, when using a pair in HA for example, failure never happens as smoothly as you plan :)

Security Policy

(Arguably) the most important point to consider here is (if you want to keep your job), you need to do whatever fulfills any security policies you must comply with. This could be your own companies internal policies, or if you take credit card details for example for on-line payment, you need to comply with PCI/DSS regulations which could require more than one IPS box in multiple places, or somewhere other than where you company policy would normally have you pace it. So be aware!

Answer 3

I'm going to come at this from a different viewpoint.

Why are you even bothering with an IPS? Who is going to monitor the logs, ensure they're not left in bypass mode for months, etc.

I'm of the view that if you are careful with firewall rules and end system maintenance they're likely useless as the only "intrusions" they're likely to detect have already been patched or are irrelevant (Windows attacks against *nix hosts etc.), and if you're not good with patching etc. then you're probably not good at managing incidents when they do happen.

You may well be required to install them for regulatory reasons and that's fine, if that's the case then you should put them where your auditor says, as the cost of arguing with them is probably more than the cost of acquiescing, even if (you believe) they're wrong.

If I was required to put one in I'd certainly put it on the inside of the firewall, as there's no sense in getting notified about "attacks" I was going to block anyway. Having an additional probe that uses the pre-firewall traffic for extra data (X got through, same source also tried Y & Z which firewall blocked) might be valuable.

Answer 4

Speaking as broadly as the question (and assuming an unlimited budget), I would "prefer" to have it in all three (and as many more as I could get) with some sort of SIEM solution tying all the data together into a more comprehensive picture.

However, depending on what you are trying to protect, any of the three will work. Without more information, I couldn't give a better answer than has already been provided.