I would at least start to consider putting up an IDS box. A very low cost system would be enough to handle the application and if you should choose togo with something like SNORT, or SNORT itself, then the software if free. I would talk with my *nix guys that are deploying this firewall andask what kind of traffic is normal for you to see. Then you would have an idea of what is normal for you network.