Company XYZ wants to implement an IPS device to detect and block well-known attacks against their network. They want a design solution where all packets that are forwarded to the network are checked a

Promiscuous mode receives a copy of traffic rather than being in the traffic path, so it can alert on attacks but cannot actively block packets in real time.

Deploying the IPS behind the firewall in inline mode is recommended because inline mode places the IPS directly in the traffic path, enabling it to actively inspect and block malicious packets before they reach the internal network. Placing it behind the firewall means the firewall first filters out obviously invalid traffic, reducing the volume of packets the IPS must inspect and thereby minimizing the performance impact on the IPS device.

Promiscuous mode in front of the firewall still cannot block traffic inline, and placing it before the firewall means it processes all external traffic including packets the firewall would have discarded anyway, increasing load unnecessarily.

Placing the IPS in front of the firewall in inline mode forces it to inspect every packet arriving from the internet before any firewall filtering occurs, significantly increasing processing load and reducing performance.