📘CompTIA Security+ (SY0-701)
When we talk about network security, two main types of solutions often come up: Firewalls and Intrusion Prevention Systems (IPS). Sometimes, these are combined into next-generation security devices.
We’ll cover:
- What firewalls and IPS do
- Types of firewalls
- Types of IPS
- How to compare them
- Cisco examples
1. Firewalls vs. Intrusion Prevention Systems
| Feature | Firewall | Intrusion Prevention System (IPS) |
|---|---|---|
| Purpose | Controls traffic entering/leaving the network | Detects and blocks malicious activity inside traffic |
| Operation | Examines traffic based on rules (like IP addresses, ports, protocols) | Examines traffic based on behavior or signatures |
| Focus | “Allow” or “Deny” traffic | “Detect” and “Prevent” attacks |
| Example traffic control | Block access to a risky website | Detect malware trying to exploit a server vulnerability |
Key Concept:
- A firewall acts like a gatekeeper, letting approved traffic through and blocking unsafe traffic.
- An IPS acts like a security analyst, inspecting traffic more deeply to detect attacks, even if the firewall allowed the traffic.
2. Types of Firewalls
Firewalls have evolved over time. The main types include:
a. Packet Filtering Firewall
- Examines packets (the basic units of network traffic).
- Checks IP addresses, port numbers, and protocols.
- Pros: Fast and simple.
- Cons: Cannot see application-level attacks.
b. Stateful Firewall
- Tracks the state of network connections (TCP handshake, session info).
- Can allow packets that belong to an established session and block others.
- Pros: More secure than packet filtering.
c. Next-Generation Firewall (NGFW)
- Combines stateful firewall + application awareness + IPS features.
- Can inspect applications, not just IP/port.
- Supports user-based policies, threat intelligence, and deep packet inspection.
Cisco Example: Cisco Firepower NGFW can block malware, control apps, and prevent attacks at the same time.
3. Types of Intrusion Prevention Systems (IPS)
IPS also has different types depending on where it sits and how it works:
a. Network-based IPS (NIPS)
- Monitors network traffic.
- Usually placed inline between network segments.
- Detects attacks like DoS, SQL injection, malware propagation.
b. Host-based IPS (HIPS)
- Installed on individual servers or endpoints.
- Detects attacks targeting specific hosts, such as unauthorized file changes or local malware.
c. Signature-based IPS
- Uses predefined signatures of known attacks.
- Very accurate for known threats but cannot detect new (zero-day) attacks.
d. Anomaly-based / Behavioral IPS
- Learns normal traffic patterns.
- Flags abnormal behavior that might indicate attacks.
- Can detect unknown threats but may generate false positives.
4. How to Compare Firewalls and IPS Solutions
When comparing network security solutions, focus on these key criteria:
- Traffic control
- Firewall: Filters traffic based on IP, port, protocol
- IPS: Detects attacks inside allowed traffic
- Threat protection
- Firewall: Good for blocking unauthorized access
- IPS: Good for detecting and stopping attacks
- Deployment
- Firewall: Usually at network perimeter
- IPS: Can be inline in network segments or on hosts
- Performance
- Firewalls are generally faster (less inspection)
- IPS can slow traffic because it inspects deeply
- Integration
- NGFWs combine firewall + IPS + application control
- Standalone IPS may provide deeper inspection and threat prevention
5. Cisco Examples
Cisco provides multiple solutions that combine firewall and IPS capabilities:
| Solution | Description | Key Features |
|---|---|---|
| Cisco ASA with FirePOWER Services | Firewall + IPS combined | Stateful firewall, application visibility, threat protection |
| Cisco Firepower NGFW | Next-generation firewall | Advanced malware protection, intrusion prevention, URL filtering |
| Cisco IOS IPS | Router-based IPS | Protects branch or network edge from known threats |
| Cisco Meraki MX | Cloud-managed firewall | NGFW features + IDS/IPS for small to medium businesses |
Exam Tips
- Understand the difference between firewall and IPS:
- Firewall = controls access
- IPS = inspects allowed traffic for attacks
- Know types of firewalls: packet filtering, stateful, NGFW.
- Know types of IPS: network-based, host-based, signature vs behavioral.
- NGFW integrates firewall + IPS + more, so it’s often seen in modern networks.
- Cisco products like ASA, Firepower, and Meraki MX are commonly referenced.
✅ Summary for Exam:
- Firewall: Gatekeeper, filters traffic based on rules.
- IPS: Security analyst, detects and blocks malicious activity inside allowed traffic.
- NGFW: Combines firewall + IPS + application control.
- Cisco ASA + FirePOWER or Firepower NGFW are examples of integrated solutions.
