To protect a server and network, if that is your question, ISA would
be ideal. It integrates with active directory and provides advanced
application filtering, a must with the advent of http applications.
What environment are you protecting? What kind of security do you
need? ISA may be ideal or overkill.