That is an extremely open ended question. A firewall can be software or hardware, free or tens of thousands of dollars. It really depends on your needs and budget as far as "best".
Of course, in the end, when you say "best", I say: Cisco.
Note that the term "web application firewall" also means different things to different people. To Cisco, it seems to mean an xml-targeted system. You may actually need a more general purpose firewall like something from the ASA series. These issues of security are multifaceted, and I'm not a PCI-DSS expert, so I'm not completely sure of the nuances with your request. However, I can tell you that whatever you need, Cisco has it, and it probably rocks, if you'll forgive the superlative.