Over the last couple of days, I've seen a sudden burst of IPS alerts from two particular IP addresses. While I have confidence in the IPS, I also see no reason to allow these sites continued access to anything I host, so I've placed them in my "Known Offenders" group which is rejected by Rule #1 on my firewall. However, I'm still getting IPS alerts from these jerks.
Am I correct in assuming that incoming traffic goes through the IPS before it hits the firewall? That seems backwards to me, but perhaps someone can suggest why it would be that way.
This thread was automatically locked due to age.
