Cisco ASA 5510 and Barracuda Webfilter or Watchguard

I've always gone with one device one job, router, switch, firewall, filter. Most devices will be great at one and OK at the other.

Always loved my ASA's too. Try to find another filter?

I have the issue that my ASA is part of the problem.   I agree with the one device one job rule but, what do i replace the ASA with? 

We've had good experience with Juniper on the firewall side. But if the budget is there (sounds like it isn't ) Palo Alto is a sound choice.

I've been using Sidewinders for 20 years.  Stable, DARPA-designed, they include a ton of features at no extra charge (HA, SmartFilter, NextGen Application Awareness, Secure Sendmail, Split DNS, etc.).  They run on a hardened Unix FreeBSD kernel, so if you know tcpdump and man pages, you're set.  I really think they're a best of breed when you add in their IPS/IDS and Real-time Threat Detection and Global Threat Analysis.  They do everything onboard that you'd otherwise have to buy separately and add in externally with ASA's.  Their GUI is totally and completely perfect IMHO, and you can do everything from one screen--including NAT and redirects .  The only thing less than perfect is their failover; in active-standby mode it isn't hitless--it takes 6 seconds, plus time for the network to learn new ARP info.  You can log all your SIEM info locally and mine it with powerful UNIX commands, and go back as far as you want to store.  Or offload it to an external SIEM.  I could talk for weeks about the benefits of Sidewinders, now rebranded as ForcePoint Firewalls, and I could step in for their instructors and teach classes on it.  I've even uploaded backup scripts to Thwack for them to be used in NCM.

I was just talking to CDW yesterday about Palo Alto and they are going to work up a quote similar to that of Fortigate and Watchguard.  that way i can compare apples to apples. 

Thanks for that, i will add it to my list of research.   I have a couple weeks before i have to pull the trigger.   But i am looking to move sooner than later.  

We still use ASA's but have recently moved a lot to Palo Alto too.  It does everything basically.  You order which ever features you want.  Also the proxying it does is inline and transparent for web proxy.

You'd be wise to poll the community about firewall support satisfaction.

I created a poll but  can not post if to the whole community, only the MVP's and other random areas.   I don't have super powers i guess.   DanielleH​ and wabbott​ keep me on a tight leash with my post ability Ha ha. 

I'd not come across these before, we're already a Forcepoint customer. We will investigate more, thanks.