Scucci,

I dont have hands on experiance with the box, as thats not my role anymore. However I have worked with a customer who had a 5540 deployed and it had a pretty decent throughput for the size of the organisation, and as you say the management interface is graphical and concise, and pretty configurable.

Obviously you will know your organisation, but I would ask CISCO for a demo unit and pop it on your network in learning mode for a while, and then trial it. Proof is in the pudding I will say.

My only observation from experiance, is that people forget that you need to make good use of the logs, and monitor them accordingly, and also dont forget you need additional license and support inplace for the IDS / IPS components in addition.

I will also add that I have had a little look at the Astaro Security Gateway, not in a commerical environment, just in a virtual lab. Not sure on the price comparisons, but again this box has some IPS functionality, as well as some other bits and bobs. You could download the free VM and try it out also.

I think these AIO devices bring real benefit in a SME, so I think you have a few options to review. Just incase I sound like a salesman I dont work or have any relationships with Cisco or Astaro. Hope it helps a little.

There are cases where having an IPS in front of the firewall makes sense. The most specific is in a hosting situation where you are trying to protect against DoS and DDoS attacks. Firewalls and UTM devices are not designed to protect against denial of service attacks. Most modern IPS devices such as TippingPoint and TpoLayer are.