I would add to that - if you have a good background in security products in general - why pay high dollars for what is essentially several open source products strung together?
There are lots of decent firewall distributions out there, and ebay is full of good used servers.
I just bought seven that cost less than one of my Sophos UTM's - and they will utterly crush Sophos.
Will they last as long as a shiny new one?
Probably not - but neither will the Sophos boxes, as they are designed to be made obsolete by feature creep in just a couple of years.
I would argue against this from a business continuity perspective. Who supports the custom system if the admin is unavailable for whatever reason? If you provide the acceptable answer for that, then by all means move forward.
