I'm currently running ISA 2004 and will soon be running an Untangle box. I've always felt a tiny bit safer putting these more advanced software firewalls behind a dumb hardware firewall (like mid-grade consumer routers). So basically I do port forwarding as necessary from the hardware firewall to the software firewall which of course has a more complex configuration.
The way I figure it, this at least protects me a bit from accidentally opening something up on the software firewall, and potentially from glitches in the software firewall. However, it really only helps me by blocking ports at the edge (well, it's a little better than that, but not much). Plus it makes configuration more complicated and it's harder to test each system independently.
Should I ditch the cheap router/firewall box?