Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec?
Even if there is need that can be implemented at cloud. Is there any need for it to present in IoT network?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Yes, you still need a firewall on your end. In the case of a DoS/DDoS, your connection would potentially be flooded to the point where your devices would not be able to establish the IPSEC tunnel and would therefore not function [properly]. If the firewall only exists on the cloud side, that does nothing for your service at your house/office.
A DoS/DDoS attack will probably not be stoppable no matter what equipment you have since it's happening at the connection level. Typically with a DoS/DDoS you deal with it further and further up the path as close to the source as can be. For example, you call your ISP so they can block it from getting to you, then they call their provider to have them block it before it gets to them, and so on. It can only be blocked so much before someone is left to take the hit but that's usually at the backbone level where they have more than enough bandwidth to deal with it until it is dealt with by other means (like finding the people causing it and stopping the attack).
Since you've mentioned it's a closed network (connected through IPSEC), instead of deploying firewall and other traditional VPN (IPSEC) networks for your IoT network, you may try to implement SDP (Software defined perimeter) solutions.
You may refer details through wiki: https://en.wikipedia.org/wiki/Software_Defined_Perimeter
Or refer working group : https://cloudsecurityalliance.org/group/software-defined-perimeter/#_overview
This could be an alternative to traditional approaches and there are commercial solutions available to try out : https://www.perimeter81.com/software-defined-perimeter-enterprise