I agree with the concerns over complexity. That said, I see nothing in the article that indicates that a firewall appliance is the correct countermeasure. Defense in depth is likely what you need (and may ultimately get) here.