The reason I said they are doorstops is not because of functionality, but the fact that they are not easily manageable in large number across an enterprise. My company quickly came to that conclusion with very little convincing.

We are replacing them with Checkpoint Firewalls