Forum Discussion
f5 BIG-IP working as IPS
AFM has an IPS now, Protocol Inspection. It provides protocol compliance checks that implement a positive security model (the traffic must match or it is alerted/dropped/rejected), and signatures that implement a negative security model (matching traffic generates alerts/is dropped or rejected). The signatures implement a subset of the Snort rules language syntax, but the matching engine is different. There's a subscription service available for updated signatures, and users can write their own custom signatures. Custom signatures are a pain due to some validation bugs, but they show a lot of promise.
As a drop-in replacement for an industry-leading IPS, it's probably not viable at this point. As an enhancement where there's already a BIG-IP, yeah it could completely avoid the need to add another device.
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com