Firewall for servers at a colo

I would recommend installing a software firewall like iptables on the servers whether or not you have a hardware firewall. The more layers of protection you have, whether to provide more walls for an attacker or to provide more places that someone would have to do something silly to allow an attacker in, the better.

That said, I would generally prefer to have both a software and a hardware firewall. There's a real issue though, if it's a managed firewall, of the skill and responsiveness of the firewall provider. If it takes them a week to open a port and you lose a customer because of it, was it worth it? The vendor you are evaluating may be awesome, this is just a consideration I would have.

So:

• definitely both a hardware and software solution
• the nature of the hardware firewall (installed by you or contracted) depends on your evaluation of price and ability of the vendor vs. the self-installed solution.

As a rule of thumb, Juniper firewalls tend to be cheaper for the same feature set. I don't have a lot of direct experience with them, though. If you stick with Cisco, then an ASA 5505 would be your best bet for replacement. As far as product line goes, the 5505 is the pix501 equivalent. However, the 5505 is actually closer to spec equivalent with the 515e. That is, the 5505 supports 150Mbps throughput as opposed to the 170(?) for the pix515e. Additionally, with the ‘Security Plus’ option the ASA supports more VLANS (with trunking), H/A, and a few more connections.