I have an Juniper SRX firewall in a branch office. All ports are blocked from Internet to Internal network. All ports are opened from Internal network to Internet. Is there any benefit to use IPS on it? Will it protect me from any type of attacks if all incoming ports a blocked?
Yes, there is a benefit and yes it can protect against certain types of problems/attacks.
Specifically you are only blocking inbound connections, any compromise that starts on one of your computers and originates an outbound connection will still work.
Compromises could be introduced to one of your local computers from a wide number of sources. Here is a brief (non-inclusive) list of attack vectors:
- email attachment
- web sites
- storage brought from outside (flash drives, disks, etc)
- devices charging on USB (for example E-Cigarettes)
An IDS/IPS monitoring your outbound traffic is able to monitor and help mitigate compromised hosts on your network from reaching the Internet. This can prevent command and control functions, the ability for someone to come back in one of those connections, installation of further malicious software, theft of data, etc.
It also provides you the additional benefit of informing you about compromised hosts so you can deal with them (possibly before they compromise other hosts on your network).