I implemented ISA Server about 2 months ago at one of my clients (stupid Small Business Server). I think it works well, but I wouldn't recommend doubling applications up on the server, as Small Business Server does, as ISA eats up resources like crazy. The configuration isn't especially intuitive, but it is fairly easy to adapt to after a while. My biggest gripe is that in order to take advantage of the monitoring, without going to the server to look at the logs, you need to buy third party software, or you have to open the ISA monitoring log files in access and write a program to query that database, either way, it is something that should be provided for, and isn't.

Oh, and don't expect it do to trustworthy intrustion detection, I get my false alarms than I'd like, but I've heard the ISS add in is decent.

Regards,
Wizeman