The inside network is accessable only through IPsec, do I need enable ios FW?

[jimmyc_2]

I'm building a remote site, and the only traffic in or out of their inside network is via IPsec tunnels.  There is no unecrypted access to the internet.  Should I still configure the ISR firewall?  If so , why?

[LJ Gabrillo]

If I get your set correctly imagined (haha)
Anyway, it really depends on you:

However, for full-tunnel setup, w/c i think you have set-up there, you can enable it for better QoS and basic site blocking as well

for split-tunnel, then configure it in your remote site.
Stateless firewall configuration in IOS really is handly, though reporting wise, its not that friendly. 
Best part of stateless firewall is it can be content based.
 

EX: 

class-map match-any FILTER

  match protocol http host *yahoo* 

  match protocol facebook 

  match protocol youtube

#class-map type urlfilter match-any CONTENT_DROP

  #match url category Adult-Mature-Content

There are more protocols as well, and (i think) even p2p protocol can be blocked (utorrent, bitorrent etc)

Content filtering however is a subscription license and needs to be registered/enabled

SEE: http://www.cisco.com/c/en/us/products/collateral/security/ios-content-filtering/white_paper_c89-492776.html

[LJ Gabrillo]

Oops, just did a bit of research and it looks like content filtering on IOS id EOS/EOL

http://www.cisco.com/c/en/us/products/collateral/security/ios-content-filtering/eol_c51-698205.html

But hey, at least the URL filtering feature is still available :D

[jimmyc_2]

Thanks for reply, but your missing the point.

There is zero access to the internet from Inside.   The servers can only talk to the main servers at headquaters via IPsec.

There is only one protocol suite that goes through the router, IPSec.

I will have SSH into the router.   That's all there is.

I don't think the ios FW will add anything above the ACL's, yes?

[LJ Gabrillo · Accepted solution]

Well if you didn't configure the IOS firewall, then it will not affect
Furthermore, even if you did configure the classes for the FW, if you didnt apply it to the interface it will still not affect