How's about IPCop, IPtables in general, and Squid; they're free, tweakable, and do everything and more that the PIX will do. Content filtering, Bandwidth management, Traffic Reporting, Site-Blocking, SMTP Proxy, by default HTTP Proxy, IPSec VPN, Transparent Proxy (very handy), and above all Mulitiple One-to-One NAT features (Microsoft ISA will NOT!!!) I won't go into the handcuffs Microsoft ISA straps on an Admin. A firewall is meant to be administered by an Admin, let the Admin administer the firewall. The last directed at Mr.Gates.