Steve,
Thanks for all your help. I think I will leave my Firebox alone for now. I am thinking about putting Snort on my Windows Server 2008. Looking at different typologies here. Looks like just need another NIC on it and SPAN a port on a switch. I am not very good with Linux…PfSense is awesome though...