What is an IPS?

An Intrusion Prevention System (IPS) is a network security control, typically deployed inline at the network perimeter, that inspects traffic for malicious or anomalous activity and automatically blocks it – dropping packets, resetting connections, or blocking source IP addresses – using signature-based and anomaly-based detection.

Key takeaways

• IPS blocks malicious traffic inline; IDS only detects and alerts on it.
• Signature-based and anomaly-based detection together catch known and new attacks.
• Deploying IPS at every ingress and egress point stops threats at the perimeter.
• Versa’s IDP module applies vulnerability profiles within NGFW access policy rules.
• Predefined profiles cover broad threats; custom profiles add Snort-format signatures.

On this page: Why it matters · How it works · Types · IPS & Versa · FAQ

Why is an IPS important?

Networks face a constant stream of exploitation attempts against known and newly disclosed vulnerabilities – flaws attackers use to steal data, deploy malware, or move laterally once inside. A firewall that only checks ports and addresses cannot see this: a session can be permitted by policy and still carry an exploit in its payload. An IPS closes that gap by inspecting traffic itself, at line rate, and acting the instant it recognizes an attack.

Prevention differs from detection operationally. An IDS flags suspicious activity for later review; an IPS, placed inline at the perimeter, drops the packet, resets the connection, or blocks the source immediately – no human in the loop. Deploying IPS at every ingress and egress point stops known exploits and zero-day attacks alike, while IDS sensors inside the firewall still give teams visibility into activity that already crossed the perimeter.

What is an IPS?

An IPS is the enforcement half of intrusion detection and prevention (IDP): it inspects live traffic against vulnerability profiles and, on a match, carries out a configured action rather than just logging it. Two techniques do the matching. Signature-based detection compares traffic against a database of known attack patterns, updated in regular security packages. Anomaly detection instead baselines normal traffic and flags deviations from it – catching attacks no signature yet exists for.

Physically, an IPS sits inline: traffic passes through the device, letting it block a packet before delivery, but also making the device a point of failure if it goes down. An IDS, by contrast, typically analyzes a mirrored copy of traffic from a span port or network tap, at the cost of only alerting rather than blocking.

Types of IPS

Vulnerability profiles fall into two categories. Predefined profiles, maintained by Versa’s security research team, are the default: general profiles such as the Versa Recommended Profile and the leaner Versa Branch Profile cover the broadest CVSS-scored threats, alongside targeted profiles for Windows, Linux, Mac OS, malware, industrial control protocols, and post-exploitation lateral movement. Custom profiles let an administrator import or hand-write signatures in Snort format, for threats a vendor database has not yet catalogued.

Response actions form a second axis, configurable per rule: alert only, drop the packet, drop the session, reject, or reset the client or server side – tuning enforcement from observational to fully blocking as confidence in a signature grows, with exemptions available for known-good traffic.

IPS & Versa

Versa’s IDP capability is part of VOS’s unified threat management, configured as a vulnerability profile and applied within an NGFW access policy rule so IPS enforcement runs alongside firewalling and application identification in one pass. Administrators typically start from a predefined profile – the Versa Recommended Profile (16 GB RAM minimum), or the lighter Versa Branch Profile (8 GB RAM) for smaller sites – and can layer override or custom Snort-signature profiles on top. See Configure Intrusion Detection and Prevention (NGFW) or the classic configuration guide.

Once deployed, Versa Director tracks signature compilation status, and Versa Analytics surfaces blocked threats, IDP logs, and packet captures for investigation.

Frequently asked questions

What is the difference between an IDS and an IPS?

An IDS monitors a copy of traffic – from a mirror port or network tap – and alerts on suspicious activity without touching the flow. An IPS sits inline and blocks the same activity automatically: dropping packets, resetting connections, or blocking the source in real time.

Where should an IPS be placed in the network?

IPS enforcement belongs at every corporate ingress and egress point, stopping threats before they enter or leave the network entirely. IDS sensors inside the firewall and at critical internal nodes add visibility into activity that has already crossed the perimeter.

What is the difference between signature-based and anomaly-based detection?

Signature-based detection matches traffic against a database of known attack patterns, updated regularly through security packages. Anomaly detection instead baselines normal traffic and flags deviations from it, which lets it catch new attacks – including zero-days – that no signature yet describes.

Can an IPS stop zero-day attacks?

Partially. Anomaly-based detection can flag zero-day exploits by recognizing traffic that deviates from a learned baseline, even without a matching signature. Signature-based detection cannot catch a zero-day until a signature exists for it, which is why most deployments run both techniques together.

Does an IPS replace a firewall?

No. A firewall controls which sessions are permitted based on zones, addresses, and applications; an IPS inspects the payload of permitted sessions for exploits and anomalies. In Versa’s architecture, IPS is a vulnerability profile applied within an NGFW policy, working alongside firewalling rather than instead of it.

More on IPS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IPS, these are worth looking at next.