I second those observations.

First, research the quality of the device, reputation and reviews. Generally speaking they don't fail often except for power surges. Second, licence terms and service options. Third, is local service support available? Review the service dept history, quality of employees…

- First, review all ports you have open. Is there any way you can eliminate it - Second, review the functions your firewall product has. With a company of up to 500 employees, you should have a fairly expensive firewall, like a unified threat management device, UTM.…