Enterasys Announces IPv6 Support For IPS: Page 2 of 2

"We use IDS as the eyes for the IPS on the network," says Dennis Boas, security solutions manager. "You still get a level of protection and get the cost benefits of being able to cover large portions of the network without having to deploy in-line IPS at every uplink." The approach is analogous to Sourcefire's IPS, which leverages distributed sensors around the  network.

Bentley College, in Waltham, Mass., uses Distributed IPS to check P2P applications and other suspicious or threatening activity, primarily on its student networks.

"We send information from the IDS into the back-end software and change policies on the switch ports," says Todd Marsh, Bentley's principal network engineer. "As opposed to traditional in-line IPS, we take four sensors and cover a lot of areas."

Enterasys IPS can also act on triggers from the company's Security Information & Event Manager (SIEM), which features flow data collection for network behavioral anomaly detection (NBAD) correlated with traditional log-based event analysis (similar to Q1 Labs' capabilities).

In addition to network-based IDS/IPS, Enterasys offers host-based intrusion detection and prevention for critical servers. All the products can be managed through a common security console.