We have a strong perimeter firewall. Would it make sense to still use IPTables on each host to hard block any and all ports except for the ones that are needed (DNS, 80 for the web server, nagios ports, etc.), or would this just lead to inefficiency. The web server gets millions of hits per day.
Yes, it is a good idea to lock down all of the hosts inside the firewall as well to protect against any threats coming from your internal network. That way, if someone gains access to your network or if there is a virus/worm/etc attacking your local machines, there are that many fewer services that could potentially be compromised.
Someone else will need to speak to the inefficiencies in this particular case, although my suspicion is that they would be negligible.
Definitely do this. I've made it a habit to deploy services using Puppet, so the allow service rules are written into the same definition file that installs the service. The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP).