What is the difference between IPS/IDS and a WAF?

Short answer

IDS monitors the traffic and reports what is suspicious, while IPS stands on the line and cuts off what it finds malicious; both carry generic patterns for many protocols and have no knowledge of the protected application. WAF focuses only on the HTTP request, parses the content down to the JSON, XML and form fields after TLS is terminated and, since it can map the application, can catch a parameter that has never been seen on an address or a POST coming to an address that accepts only GET (the difference from the network firewall and IPS/IDS). In TR7 WAF, the counterpart of the distinction between monitoring and blocking is the WAF Mode selected per Virtual Host Group: in Monitor mode, a request that reaches the threshold is recorded but passes, and in Blocking mode it is blocked. In TR7, there is no separate product or setting named IPS/IDS; attacks at the packet and connection layer are met with L4 DDoS Protection.

Comparison

	IDS	IPS	TR7 WAF
Position	Monitors a copy of the traffic	On the line	On the line (HTTP vService)
Reaction	Alert	Cuts off	Records or blocks according to the mode
Protocol	Many	Many	Only HTTP
Encrypted traffic	It cannot see the content	It cannot see the content unless it terminates the traffic	It sees the content after TLS is terminated on TR7
Application knowledge	None	None	Learned Page Types: allowed methods, parameters, length limits
Counterpart in TR7	-	-	Monitor mode corresponds to monitoring, and Blocking mode to blocking (What are the WAF operating modes?)

Monitoring and Blocking in TR7

• In the Monitor and Blocking modes, all the inspections work in the same way; the only difference is whether the decision is applied to the traffic or not. In Learning, the third mode, no request is blocked, only signature scanning is performed and the traffic is written to the learning record (runtime behavior of the modes).
• The mode is assigned not to the whole vService but to the Virtual Host Group; on the same vService, one domain name can work in Blocking and another in Monitor.
• In Monitor mode, the requests that reach the threshold appear in Event Logs as "Not blocked — Monitor mode".

Common Misconceptions

• "TR7 WAF has an IPS mode." There is no setting named IPS/IDS in the interface; monitoring and blocking are selected with WAF Mode.
• "Monitor mode protects." In Monitor mode, attacks that reach the threshold are also forwarded to the Backend Service; for protection, the mode is switched to Blocking (What is the risk of staying in Monitor mode; is there a time limit for Monitor mode?).

How it is done in the documentation

• WAF - WAAP · The Difference from the Network Firewall and IPS/IDS
• WAF Mode · Runtime Behavior of the Modes
• WAF - WAAP · Two Security Models

Related questions

• I already have a network firewall; why would I also need a WAF?
• What are the WAF operating modes?
• What is the difference between the negative security model (signature scanning) and the positive security model?