Is a firewall all you need?

Hey everyone,

Having a discussion about the end of Win XP. My boss has no intentions of upgrading or not anytime soon anyways. He just keeps saying we are behind a firewall.

So before I argue the point. Is there no reason then to get enterprise virus software to protect your enterprise if you have a firewall?

We are using a Contivity 1750 firewall. 

I just figured that there should still be other types of security other than just a firewall?

I am very "green" when it comes to network security.

Thank You