Data Center Firewall considerations

Hi,

We are currently evaluating a new data center firewall and there is one fundamental topic which I would like to resolve upfront.

At the moment, we have a dedicated forward proxy farm (approx 20k users) and one option is to get a big data center firewall and run a proxy blade on it instead of the dedicated proxy farm. We have had enough problems with our firewalls even without a huge proxy farm running on it as well.

What are your opinions?

1 - One big firewall which handles everything (Firewalling, Proxy, IPs, Application Control, VPN, ...)

or

2 - a slightly smaller box and dedicated services (the classical approach).

or

3 - Or maybe something between, e.g. IPS as blade, but dedicated proxy farm.

​

thanks,

max