To any NIDS newbies out there... Please don't deploy this in-line. Ever. You should always have your IDS out-of-band. Software like Snort is great for detecting threats, but if you block every "threat" you're going to have a bad time. Not to disparage the quality of their rulesets, they are very high quality, but there absolutely will be false positives. I've spent many evenings and weekends troubleshooting IPS problems, 0/10 cannot recommend.

The best option is to mirror all traffic from switches directly to capture boxes where the detection and logging happens. This should be sent to a central system that has a full picture of the network and traffic patterns. That central system should be the one making the decisions, and it should be very smart. Automatic firewall rules should be close to the source, and shutdown switchports should be close to the client.

For safe IPS operation there needs to be several layers of filters, not just a list of "allowed rule IDs". This is the sort of project that takes at least a year to fully roll out - it's not the kind of thing a "security whiz" can set up in an afternoon.

At best, it can be a very useful diagnostic, logging, and threat detection tool. At worst, it can cause very difficult to predict and troubleshoot network problems.