IPS - do you use it on incoming only or outgoing as well

[Ian_Harrison]

Hi

The connections to our internal sites are checked by IPS rules I just wondered does anyone apply IPS checking to outbound traffic as well such as user web browsing etc.  I know that the IPS puts a load on the Firewall so want to know what other people did as well.

Thanks for any info.

Ian

[ponder]

I think outbound you would apply DLP rules ?

Can't say I use it though.

[emnoc]

I hate to  use in or out going but rather use "protect server" or "protect client", with that said most establishment proper use both and even dual tiered ( external IDS/IPS  sensor + internal IDS/IPS sensor )

[razor]

Incoming only. I create my own IPS rules to protect the users against the latest threats. (Snort rules can be used!:) )

[ede_pfau]

If you control guest access to the Net IPS on outgoing traffic is valuable. I use a rate-limited sensor to block excess mail sending (SMTP) to mediate SPAM outbreaks. Sender will be quarantined for 24 hours (or for good) if sending more than 100 emails per minute.

Otherwise, if undetected the ISP will blacklist the mailserver for days at least, with desastrious consequences.