Firewalls and intrusion prevention systems
Also known as: firewall and IPS
Firewalls and intrusion prevention systems (IPS) are network security devices that control and inspect traffic. A firewall permits or denies traffic based on configured rules, while an IPS analyzes traffic for attack patterns and blocks malicious activity in real time.
Firewalls and intrusion prevention systems are complementary layers of network defense, typically deployed at the boundary between a trusted internal network and untrusted networks like the internet. A firewall enforces an access policy: it examines traffic and permits or denies it according to rules based on source and destination addresses, ports, and protocols. An IPS goes deeper, inspecting the content and behavior of traffic to detect and stop attacks that would be perfectly legal by firewall rules alone.
Firewalls come in several generations. Traditional packet-filtering firewalls evaluate each packet in isolation, while stateful firewalls — the standard today — track the state of connections, automatically permitting return traffic for sessions initiated from inside. Next-generation firewalls (NGFWs) add application awareness, user identity, and integrated threat inspection, making decisions based on what application is in the traffic rather than just its port number.
An IPS detects threats using signature-based matching against a database of known attack patterns, plus anomaly-based methods that flag deviations from normal behavior. The key distinction from an intrusion detection system (IDS) is placement and action: an IPS sits inline in the traffic path and can drop malicious packets or reset connections as they happen, while an IDS receives a copy of traffic and can only alert after the fact. The trade-off is that an inline IPS adds latency and can block legitimate traffic on a false positive.
The CCNA exam covers firewalls and IPS in its security fundamentals domain: know the difference between stateful firewalls and packet filters, next-generation firewall and IPS capabilities, IPS versus IDS placement and behavior, and where these devices sit in a secure network design.
Key takeaways
- A firewall permits or denies traffic based on rules; an IPS inspects traffic content and blocks detected attacks.
- Stateful firewalls track connection state and automatically allow return traffic for internally initiated sessions.
- Next-generation firewalls add application awareness and integrated threat inspection beyond port-based filtering.
- An IPS sits inline and actively blocks threats; an IDS only monitors copies of traffic and generates alerts.
- The CCNA tests firewall types, IPS versus IDS behavior, and their placement in network security design.