I second the Barracuda. We had Surfcontrol and bought 2 Barracuda 300s. With updates and 24hr replacement they cost us less than the annual maint. renewal for Surfcontrol. It also moved spam filtering off of the mailbox server and onto the appliances. With the outbound mode available in 3.3 my mailbox server has been completely isolated from the internet.