This is just stupid (sorry). There are so many attacks that come over well-defined ports and services. IPS isn't just about stopping the random hacker port-scanning, it's also about deep packet inspection, eg when one of your users is file-sharing with a P2P app that tunnels over HTTP and they bring in something they didn't expect, or look at all the 0-day IIS attacks. What about SMTP attacks or SSH attacks? You might legitimately let SMTP between your DMZ and your internal network thinking "I've got a firewall and a virus scanner", but sometimes it's not enough.

If you really want assurance, go for Defence In Depth - adaptive firewalls, intrusion detection at the network level with prevention, host-based intrusion detection agents and most importantly the right management tools to ensure you see the hacks from the scans.