ckeleshianm, what's on the client end of your VPN tunnels?
If you expect to pull the tunnels directly to Windows client boxes, I can't strongly enough recommend the Cisco VPN client. Which is basically a freebie if and only if you have a Cisco device serving the clients. Their Windows client is by far the best I've seen. Their firewalls are all not quite where they should be. The PIX is okay, the 506E is about $1k and will get you to 25 clients. The problem is, it's now a dead-end platform. Their replacement is to use the new ISR series routers, the 800/1800/2800/3800, check the 800 and 1800 for your needs. They have good performance and features, especially for their price, but they also come with more than acceptable bugs. Until that platform is more mature I'd be cautious about using it. There's also Cisco's VPN Concentrator series, which are very expensive.
The firewalls you listed to ask about, I think all of them do not come with a Windows IPsec VPN client. That means you need to buy an IPsec VPN client such as SSH Sentinel to be able to connect to them. (Or try to use the one built into Windows, which is extremely crippled, and pretty much futile). VPN clients tend to go for $50-$100 per system they're installed on, which all the sudden makes the lower end firewalls not be such a good deal anymore. The same goes for any Linux or BSD solution like Moonwall, great firewall but without a good Windows client you might not have a usable solution.
Sonicwalls never appealled to me. They're okay. Limited functionality. Did they ever add a CLI? If there's no CLI, it's still a toy to me. The boxes themselves work, though.
I don't like the Contivity, and doubly don't like Nortel.
Netgear has gone far, far downhill since they were part of Nortel. Indian tech support on Chinese hardware and software. If you trust your network to this, you get what you pay for. D-Link is a little better but the same fundamental equation, as is Linksys. I don't build corporate networks on home-grade gear, in the long run it just isn't cost effective (remember, skilled labor to maintain the network, and employee productivity, are not free).
ZyXEL is also SOHO grade, but I've heard a lot of good things about them. Never used their gear though.
OpenBSD and PF is a great firewall, requires a lot of UNIX skills to set up and run. Linux is not as good a firewall but distributions like Moonwall make it reasonably easy to install and maintain. If your IPsec clients are hardware based, that might be a great option, just run it on a $300 Dell SC420 or similar.
In your particular environment, I'd put in a PIX 506E with a huge disclaimer that the box is unlikely to get anything other than critical security updates - i.e., no new features.
