Switch, router, firewall, IDS and IPS compared
Each device is defined by what it reads in the packet
A switch forwards frames inside one network using MAC addresses. A router forwards packets between networks using IP addresses. A firewall permits or blocks traffic by policy, based on addresses, ports, connection state or application. An IDS (intrusion detection system) watches traffic and raises alerts; an IPS (intrusion prevention system) sits in the path and can also drop the traffic. The decision rule for exam questions: find the layer the requirement talks about (MAC, IP, port or application, malicious pattern) and pick the device whose job is that layer, then check whether the requirement says “detect” or “block”.
| Device | Reads | Decides | Typical OSI layer |
|---|---|---|---|
| Switch | Destination MAC address, VLAN tag | Which port(s) to send the frame out of | 2 |
| Layer 3 switch | MAC addresses and IP addresses | Switches within a VLAN, routes between VLANs | 2 and 3 |
| Router | Destination IP address | Which next hop, using the routing table | 3 |
| Packet filter or stateless firewall | Source and destination IP, protocol, port | Permit or deny each packet on its own | 3 and 4 |
| Stateful firewall | The above plus connection state | Permit replies to connections an inside host started | 3 and 4 |
| Next-generation firewall (NGFW) | The above plus application, user, content | Policy by application or user, often with IPS built in | up to 7 |
| WAF | HTTP requests | Block web attacks such as injection | 7 |
| IDS | A copy of the traffic | Raise an alert; cannot stop the packet itself | any |
| IPS | Traffic passing through it | Drop or reset malicious traffic | any |
Following one packet from a PC to a web server
A PC at 10.1.1.10 opens a web page on 203.0.113.80. Three devices handle it, and each one shows its job.
- Switch. The PC does not know the server’s MAC; the server is on another network, so the frame is addressed to the default gateway’s MAC. The switch looked at the source MAC when frames arrived, learned which port it came from, and forwards this frame out of the port where the gateway’s MAC was learned. If it had never seen that destination MAC, it would flood the frame out of all other ports in the VLAN. Switches never change the IP header.
- Router. The router receives the frame, strips the Layer 2 header, looks up 203.0.113.80 in its routing table and chooses a next hop. It decrements the TTL by one (RFC 1812), writes a new Layer 2 header for the next link and forwards. When the TTL reaches zero the packet is discarded and an ICMP “time exceeded” message goes back (RFC 792). That is the mechanism traceroute exploits, covered in troubleshooting commands.
- Firewall. At the network edge a stateful firewall sees TCP port 443 from an inside host to an outside server and allows it. It records the connection, so the server’s replies are allowed back although no rule permits inbound traffic from the internet. An unsolicited packet from the internet to the PC matches no connection and is dropped.
Source and destination IP addresses stay the same end to end (unless NAT rewrites them); the MAC addresses change at every router hop.
IDS or IPS: where it sits decides what it can do
An IDS is placed out of band: it receives a copy of the traffic from a switch mirror port (SPAN) or a network tap, so it does not slow or break the live path, and it can only alert (or ask another device to act). An IPS is placed inline: traffic flows through it, so it can drop a packet, reset a connection or block a source. The price of inline is that a failed or overloaded IPS can interrupt traffic (it can be set to fail open to keep traffic flowing or fail closed to keep the network safe) and that a false positive blocks legitimate traffic, whereas a false positive on an IDS is only a noisy alert.
Two further axes appear in the CompTIA wording: network-based (NIDS, NIPS) watches a network segment, host-based (HIDS, HIPS) runs on one machine and sees things the network cannot, such as file changes. Detection can be signature-based (known patterns) or anomaly-based (departures from a baseline); signatures miss new attacks, anomaly methods raise more false alarms. NIST describes both technologies in SP 800-94, the guide to intrusion detection and prevention systems (published 2007; NIST has announced new guidance but not published it). Many vendors now ship IPS as a feature of an NGFW, which is why Cisco’s CCNA lists “next-generation firewalls and IPS” together.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| N10-009 | Networking Concepts (23%), objective 1.2: compare router, switch, firewall, IDS/IPS, load balancer, proxy and more. Network Security (14%), 4.3: trusted versus untrusted zones and screened subnet | Networking concepts, Network security |
| 200-301 | v1.1 (until Feb 2, 2027): Network Fundamentals (20%), 1.1, role of routers, L2/L3 switches, next-generation firewalls and IPS. Not a named objective in v2.0 | Infrastructure (25%) |
| SY0-801 | Security Operations (27%), 4.1: IDS/IPS (NIDS/NIPS, HIDS/HIPS, WIPS) and firewall types (WAF, UTM, Layer 4 versus Layer 7, rule-based). Security Architecture (19%), 3.2: device placement and security zones. V8 launches Nov 17, 2026; SY0-701 until then | Security operations, Security architecture |
| 200-901 | Network Fundamentals (15%), 6.3 and 6.4: function of switches, routers, firewalls and load balancers, and reading a topology diagram. Application Deployment and Security (15%), 4.9: firewall, DNS, load balancer and reverse proxy in deployment | Network fundamentals |
| SC-900 | Security solutions (35 to 40%): Azure Firewall and Web Application Firewall, as cloud products | Security solutions; see also Azure Firewall vs NSG vs WAF |
| SC-500 | Secure storage, databases and networking (25 to 30%): configure Azure Firewall and Web Application Firewall (minor here, product level) | Storage, databases and networking |
How device questions are built
- Detect versus prevent. “Alert the security team” is an IDS; “automatically block” needs an IPS inline. If the scenario says the device must not affect production traffic, it is out of band and therefore detection only.
- Layer words. “By MAC address” is a switch, “between VLANs” needs routing (router or Layer 3 switch), “by application or URL” needs an NGFW or proxy, “SQL injection against a web app” needs a WAF. See VLANs and trunking for why VLANs need routing.
- Stateless versus stateful. If return traffic must be allowed automatically, the answer is stateful. A plain ACL on a router is stateless.
- Host versus network. Activity that never crosses the wire (a local file change) needs a host-based sensor.
- Placement. Public servers go in a screened subnet between two firewall policies, not on the inside network; see zero trust for why placement alone is not trust.
Practice questions
Question 1. A security team wants to be alerted about suspicious traffic to the data centre but must guarantee that the monitoring device can never interrupt production traffic if it fails. How should the sensor be deployed?
- A. An inline IPS configured to fail closed
- B. A stateless packet filter on the core router
- C. A second default gateway in front of the servers
- D. An IDS connected to a SPAN port
Show answer
Answer: D
An IDS fed by a SPAN port or network tap receives a copy of the traffic out of band, so a failure cannot break the live path, and it can only alert. An inline IPS can block but a failure can interrupt traffic unless it fails open. A stateless packet filter does not inspect for intrusions. A second default gateway adds a routing hop and detects nothing.
Question 2. Hosts in VLAN 10 and VLAN 20 on the same switch cannot reach each other, although each VLAN works internally. Which device function is missing?
- A. A router or Layer 3 switch routing between the VLANs
- B. An additional Layer 2 switch
- C. An IDS watching both VLANs
- D. A stateful firewall alone, without routing
Show answer
Answer: A
Different VLANs are different Layer 3 networks, so traffic between them must be routed: a router or a Layer 3 switch with an interface for each VLAN. A second switch only adds ports. An IDS cannot forward traffic between networks. A stateful firewall can filter between the VLANs but still needs routing to connect them.
Go deeper
- NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems for IDS and IPS terms.
- RFC 1812, Requirements for IP Version 4 Routers for the forwarding steps routers perform.
- On this site: VPN types and IPsec, spanning tree, OSI vs TCP/IP, and the skills outline.