NGIPS + NGFW: Why BOTH are needed in your network security infrastructure
The common question is always asked by users: Do you really need both a next-generation firewall (NGFW) and next-generation intrusion prevention system (NGIPS) for my network security infrastructure? Well, the answer is YES!
What does a next-generation firewall do? The NGFW has its core competencies and it includes:
- Network address translation
- Acting as a stateful firewall
- VPN concentrator
- Application visibility and control
- And don’t forget, IPS inspection
A next-generation IPS has its core competencies and they include:
- Inspect asymmetric traffic flows
- Perform as a transparent bump-in-the wire inspection device
- Provide visibility and protection by inspecting network traffic that moves lateral to a perimeter firewall
Since the NGFW is a network device, it can operate lower in the OSI stack and can act as a network boundary or create a network pinch-point perfect for stateful firewalling, application identification, and deep packet inspection.
Using a NGIPS to perform deep packet inspection makes for a more effective strategy against the would-be-adversary. Because an NGIPS does not maintain a state table, it is less vulnerable to attacks that exploit state table exhaustion and result in denial of service. This also gives it the ability to inspect asymmetric data flows. The NGIPS is also a transparent device, just a bump in the wire, allowing traffic to flow as if it is not even there, even if it is deployed in the core, doing deep packet inspection or on the network edge.
Did you know that traffic looks differently in the core vs. the edge of the network? Advanced persistent threats are more easily detected by the NGIPS. Because the NGIPS can be deployed where it will have of the lateral visibility of the traffic, it gives you that advantage over a firewall. A traditional stateful firewall cannot provide this. The lateral visibility it is perfect to identifying machines on a network that have already been compromised and are being used by a bad guy to collect and infiltrate sensitive or important data.
Visibility and the ability to secure a network at the perimeter and at the network core should be essential for every organization that wants to strengthen their overall security posture.
From https://www.linkedin.com/pulse/ngips-ngfw-why-both-needed-your-network-security-vino-thava/
Learn more: Migration Recommendations for Cisco IPS and FirePOWER-NGIPS Series
The Most Common NGFW Deployment Scenarios
Cisco Firepower NGIPS Data Sheet
More reference: