PIX 501 is a real firewall

This is the only firewall to use. It has it all: VPN clients that are included in the cost of the unit, a set of intrusion detections rules/filters that work, and most of all access control lists (ACL's) that are understandable. If you're worried about getting the unit setup, then buy the SMART-Net maintenance and then you will have access to Cisco's support for setup or problems.