As Graham properly pointed out, firewall isn't a "magic word" that'll secure your systems.
Allow me to elaborate. I'm going ahead on the assumption that you've got multiple data centers containing systems that you want to hotlink on an internal network. That's what you'll be using a VPN (Virtual Private Network) for (ie. to connect all your systems on an internal private non-physical network) .
A firewall is simply a program that filters incoming and outgoing traffic from different programs. It helps secure your systems because it ensures that only authorized traffic goes through (like security checks in an airport).
My point is that, a firewall needs appropriate rules to be setup before it can be of any use. More on, any mistake in these rules will lead to a security vulnerability.
Furthermore, firewalls in case of VPNs slightly complicate things, because you need to filter not only the traffic coming from the internet but also internal.
A good example of this is if you do not have a properly setup firewall internally, then you will be vulnerable to attacks coming from any servers inside your internal network (any compromised servers or servers being used for malicious intent).
What you need to ensure in a nut shell:
- Ask your network administrator to lay out a list of TCP and UDP ports that cannot be blocked or are essential for your server to run.
- Get your engineer to setup the firewall based on these requirements.
- Then get a security professional to give you a network vulnerability assessment report for any possible problems in the setup of the firewall to ensure all's good. :)
"The Cisco Intrusion Prevention System Advanced Integration Module
(IPS AIM) and Network Module Enhanced (IPS NME) bring integrated
intrusion prevention to enterprise branch offices."
Essentially it is a simpler to implement program that tries to do the job of a firewall. An IPS or IDS (Intrusion Prevention/Detection System) at a most primitive and basic level do the job of evaluating any input or traffic for particular signatures, etc that may indicate unauthorized use or maliciousness intent. They're good because the signature comes built in. Such security solutions are widely acknowledged in banks are other high security sections, and thus are more than good for a data center. They're also debatable easier to setup then a firewall.
But at a higher level of knowledge, a firewall is generally based on a policy that says, "Only allow Apache and MySQL to take and send traffic." while an IDS uses checks such as "If Apache is sending traffic, is the traffic it is receiving and sending malicious."
- Eg. A IDS will stop a SQL Injection Vulnerability, a firewall will
- Eg. A firewall will stop a reverse tcp shell from giving a
hacker remote access while an IDS may not.
As per my understanding of security, you will need both, a well configured firewall and a good IDS/IPS.
I hope I was able to do justice to your question. Please comment any doubts or feedback on my answer.