IPS vs Firewawall

Clarifications

http://en.wikipedia.org/wiki/Intrusion-prevention_system

Read the section detailing differences between application firewalls.

Some thoughts...

Firewall is only controlling incoming and outgoing traffic/access in a stateful manner and based on access-list definition (define source and destination host/network, as well as TCP/UDP service port). New generations of firewalls normally has built-in or optional IPS module.

However, Firewall is only able to check/control traffic flow up to Layer 4, and unable to block any malicious contents embedded in the data packets.

Now, this is where IPS need to get involve. IPS is specifically functioned to perform deep packet inspection for a data packet up to Layer 7 (remember OSI 7 Layers?). This is something that firewall could't do. With IPS, any malicious contents potentially able to be contained/blocked/prevented from flowing into the network or PC/servers. The method of preventing bad traffic depending on the available options - either by resetting the TCP connections (TCP reset) between the offending and target machines, automatically directing the switches/routers to block the offending/attacker IP or IPS itself to drop/block the traffic from flowing/passing through it.

Depending on security policy and network size, you can put IPS before the firewall, or even before and after firewall for comprehensive traffic cleanup. Also, depending on vendor, IPS rely on signatures that matches the offending traffic footprints/patterns. But some vendors, one of them is Cisco, has an advance inspection engine that able to detect new threats using a unique inspection pattern/method.

Nevertheless, please bear in mind that putting firewall itself, or combination of firewall and IPS, will not guarantee that your network is 100% safe. You still need a good security policy to control what is allowed, and what is bad for your network. This is followed with a good support of anti-virus and host-based IPS softwares to protect servers & clients.