IPS - do you use it on incoming only or outgoing as well

Forum|Forum|10 years ago
January 19, 2016
4 replies
13831 views

Hi

The connections to our internal sites are checked by IPS rules I just wondered does anyone apply IPS checking to outbound traffic as well such as user web browsing etc. I know that the IPS puts a load on the Firewall so want to know what other people did as well.

Thanks for any info.

Ian

ponder

New Member

I think outbound you would apply DLP rules ?

Can't say I use it though.

emnoc

New Member

I hate to use in or out going but rather use "protect server" or "protect client", with that said most establishment proper use both and even dual tiered ( external IDS/IPS sensor + internal IDS/IPS sensor )

razor

Visitor III

Incoming only. I create my own IPS rules to protect the users against the latest threats. (Snort rules can be used!:) )

ede_pfau

SuperUser

If you control guest access to the Net IPS on outgoing traffic is valuable. I use a rate-limited sensor to block excess mail sending (SMTP) to mediate SPAM outbreaks. Sender will be quarantined for 24 hours (or for good) if sending more than 100 emails per minute.

Otherwise, if undetected the ISP will blacklist the mailserver for days at least, with desastrious consequences.

Sign up

Login with SSO

Login to the community

Login with SSO