Why do we need IPS?

Firewalls are essential. They control traffic flows based on IPs and ports. Additionally, modern NGFW firewalls can control traffic based on FQDN, geolocation, and NBAR. This gives the network a strong first layer of protection. However, a firewall alone is not enough.

The problem is that firewall rules are static configurations. For example, User 1 cannot reach User 2 on port 80 because rule X blocks it. However, User 1 can reach User 2 on port 123 because rule Y allows it. Well, what if I find a vulnerability on port 123 and exploit it? Will the firewall change its rule in real time and stop me? No, the rule is static. It is either configured or not… 

A firewall can block one traffic flow and allow another based on what the rule says, but it does not truly understand whether the allowed traffic is malicious. This is where IPS becomes important. An IPS does not just look at where the traffic is going. It also inspects the traffic itself for known attack patterns, exploits, and suspicious behavior. In other words, the firewall says if traffic is allowed, while the IPS checks whether that allowed traffic is actually safe.

For example, a user may try to exploit an SQL injection vulnerability in the company’s internal web portal. The user already has access to the web server, and the firewall allows the traffic because employees must be able to open the portal.

This is where IPS becomes important. The router’s integrated Intrusion Prevention System inspects the allowed traffic and sends it to the detection engine for analysis. The SQL injection attempt matches the signature of a known attack, so the router identifies it as malicious and drops the traffic before it can reach the web server.