I'd use several dedicated boxes..

First reason, prevent SPF (Single Point of Failure) if this all-in-one box dies you'll be left with nothing.. It'll happen sooner or later..
Second reason, you can choose the best bang for your money per function..
Third, it's way more scalable.. You can replace parts like lego bricks..

NB I'd also never ever use ISA as a firewall. It's a good proxy but the firewall is based on the IP stack of windows So i'd use a dedicated hardware firewall like Cisco's PIX, Checkpoint FW/1 (on Nokia hardware) or a Netscreen..