Not to mention Cisco's PIX is only a filtering firewall, there is no higher layer filter built in. For the cost, I would recommend Checkpoint or ISA Server 2004 but it is something that may be discussed (PIX have its advantages, ISA or Checkpoint have theirs). Another solution could be BSD (best one if you ask me is OpenBSD but FreeBSD isn't that bad, never tried NetBSD) or (argh !) Linux, cheaper (well, free actually) but no support. If cost isn't your main concern and if you only use Microsoft products, go with ISA Server 2004, it is a very very very good Proxy / Firewall (ppl stating the opposite never even tried it, I used to be a Checkpoint / Borderware fan, I am now an ISA fan).