The Cisco PIX is hardware firewall that can do NAT, IP filtering and depending on the model IPSec connections. The major problem I've seen with the PIX is the lack of true port filtering rules. The PIX comes out of the box denying all inbound, which is nice for a security but unless your really familiar with the CLI that cisco has it can be confusing on how to set everything up on it.