There are many similarities between the capabilities of IPS and the next-generation firewall. However, do not forget that the reason that IDS was first thought of was because security analysts determined that, no matter how strong a firewall is, some malicious traffic will always get through. IPSs are IDSs with added mitigation strategies. So, a firewall operates at the boundary of the network to block all malicious traffic and the IPS operates within the network as a second line of defense.