@chasinreno It doesn't sound like the firewall itself failed you. What kind of bot was it? How did it come in? How and where did you find it?
The firewall CAN do AV scanning but if it was sent over an HTTPS connection then it would need to perform a MITM attack in order to be able to scan the download. AV scanning is best left to being able to view it in an unencrypted format, like directly on the PC. Paid AV has extra features like better scanning for fileless attacks, advanced script protection, or firewalls but I've found the real strength of the paid versions is the management, reporting, and support during an infection.
In this case it sounds like the firewall did its job. It found malicious traffic going across the network and stopped it. IDS/IPS protects network traffic by, essentially, profiles. It protects based on the reputation of the remote network and the type of traffic being sent. It doesn't determine whether that traffic is good or bad. For example, if I want to port forward for SQL queries but I've blocked that in my IDS, it will be blocked. It doesn't care if it is me (good) or an attacker (bad). In this case, you downloaded a file (a legitimate type of traffic) from a site not blocked via IDS/IPS (a site with a neutral or better reputation) but then that file began sending traffic the IDS/IPS didn't like (NOT legitimate traffic) maybe to a site that was blocked (perhaps a poor reputation. That's what's supposed to happen.
What appears to have failed you is your AV. It's best to figure out what got in and how, upload the infected files to virustotal (for crowdsourcing) and report it to the AV company. What was the infection and what was the AV you were using? When you upload it to virustutal it should give you a like. Post it here, I'd be curious to see what it was.
