Cisco has great stuff, don’t get me wrong, but I would equate it to this … you save to buy a Porsche, maybe you get a deal on a slightly used one, but you don’t bother to check on the cost of insurance, replacement parts, and maintenance… you soon come to the realization that maybe you should have gone with something else, or maybe you weren’t quite ready for the Porsche just yet (you can sub in whatever car you want, but you get the idea … you have to look at what works in your setup & company structure)

Ciao for now, from the Great White North!

You might want to consider using your existing firewall appliances as external screening FWs and use ISA as the internal FW/VPN server. This way the external firewalls wouldn’t need much attention since they wouldn’t be involved in VPNs and their rules wouldn’t change often.
You shouldn’t have much trouble finding support for ISA. It seems like everyone wants to support microsoft products.

The PIX GUI is clumsy but usable. We haven’t had problems with clients connecting to our PIX although we are having issues with an internal PIX client connecting to an outside vendor. It seems there is a problem using the PIX client on 2003. When we configured the PIX, there was only one thing I had to do on the command line. I can’t speak to support since we didn’t have issues during the warrenty. I didn’t consider it very difficult to learn but I am constantly irritated by the things I can do cleanly with bsd but stumble through on the PIX.

If the timing had been different we could have ended up with a PIX on the outside and the newer ISA on the inside.

If I thought you were more adventurous, I would suggest running linux with webmin. We use this with iptables as the built in firewall on our DNS servers in the DMZ and the GUI straight jacket isn’t nearly as tight as most others I have experienced. I haven’t had the need but I suspect I could do nearly anything available with the iptables command line.

In summary, I agree the PIX is expensive but reliable. Since your experiences with inexpensive firewalls has been negative, you should seriously consider cisco, nokia, and possibly 3com. If you are going to run a screening outer firewall and an inner FW, then look at ISA. As I indicated earlier, there is no best firewall. You need to select the best compromise of security, features, managability, support, and price for your environment.
rt

If tech support is an issue, don’t pursue SonicWall. I’ve got a SonicWall firewall & a sonicwall ssl vpn box. Besides the slow support, I have to reboot the firewall every month. (It’s the firewall for my guest network, so I live with it…).

Pix
I’ve been using Pix for years. It’s much more expensive than other solutions, it’s harder to learn…but it runs and runs and runs and runs. When I do have an issue, support response time is adequate. As for the pix gui, it’s pretty much worthless, IMO. (I never use it). I’ve never had any Cisco training and I’m able to fumble my through it. I hired an expert to do the initial configuration/setup and I’m able to make minor changes on my own.

With that said, a couple of comments:
Both WatchGuard and SonicWall seem to do a good job for the cost. They are easy to manage, easy to configure, and very cost effective if their feature sets fit your needs. If you are a smaller organization, these are still boxes to seriously consider.

Tthe Cisco equipment is not as easy to configure nor manage. Often it is just plain not easy. The skill/knowledge , and just patience, required can be high.
It has many great features, and is often very flexible equipment. You do need to be careful that you are sizing it appropriately for what you are trying to do with it.

Whatever you do, it will not be an easy path to get everyone on the same page. There are no migration paths or conversions to easily tranfer firewall settings from one brand to another, so any new firewall that replaces one from another vendor will require configuration from the ground up.

I do like the WatchGuards for their ease of configuration. If you go with PIX, and have Exchange servers, there is a special configuaration you need to implement to allow mail traffic through–no biggie, but I know it has tripped up a lot of Exchange installations.I’ve only worked with lower end 3COM firewalls, so I can’t really say much about them. The SonicWalls seem to have a problem dropping licensed connections after the computers have been disconnected from them, and you eventually run out of licenses–never have gotten a fix for that from SonicWall, so those installations get rebooted on a regular basis.