Centally managed Stateful Inspection/Application Filtering firewalls

Hi all,

I was wondering what infosec managers around here use for software firewalls on servers?

After testing Outpost Office, Zone Alarm, Sygate and Point Check I've found either they bundle an IDS system which is hard to disable/ the audits are incomplete or not customizable or managing these firewalls from a central point is not well done (blocks all connections after a restart/ you can't send configuration changes instead they check the central point for any changes and update themselves)

Kind Regards