Thanks for your replies. I have the PFsense box setup in parallel, on a test LAN now, and I think I can set it up to talk to the Town's DC/DNS for further testing. Beyond that, I should be able to cut it over during off hours.
We're not using any of the AD integration features of ISA (firewall rules are all IP-based), and I'd like to do basic traffic shaping for our future VOIP phone system. I'm not planning anything too fancy, just making sure there's a small amount of bandwidth available for our staff computers at all times to prevent lag/high pings. I work at a public library so we try not to filter or limit too much.
We also have two domain controllers running that only support ISA, since they switched over to the Town's domain a few years back but did not want to remove ISA from it's original domain. Yikes!