Core i3 6320 vs Xeon E3-1200

more ghz is always better for UTM because of snort.  What is your wan speed going to be and how many devices?

WAN speed will be 500/500.  Probably 30 or so devices on the LAN side, although only 1 or two devices will contribute to the vast majority of throughput.  The sophos device will have Qty 4 Intel I210 devices, but I also ordered a quad Broadcom NetExtreme II with BCM5709 chips off Ebay since there had been some chatter about Intel having some issues recently - I will use whichever has better performance when I get the hardware.

WAN speed will be 500/500.  Probably 30 or so devices on the LAN side, although only 1 or two devices will contribute to the vast majority of throughput.  The sophos device will have Qty 4 Intel I210 devices, but I also ordered a quad Broadcom NetExtreme II with BCM5709 chips off Ebay since there had been some chatter about Intel having some issues recently - I will use whichever has better performance when I get the hardware.

Chris C said:

WAN speed will be 500/500.  Probably 30 or so devices on the LAN side, although only 1 or two devices will contribute to the vast majority of throughput.  The sophos device will have Qty 4 Intel I210 devices, but I also ordered a quad Broadcom NetExtreme II with BCM5709 chips off Ebay since there had been some chatter about Intel having some issues recently - I will use whichever has better performance when I get the hardware.

What modules do you intend on running?  Intel chips are fine as long as they are not 825XX verizion.  The i-series work fine.  

Modules: Firewall, IPS, Web filtering, Remote access VPN, Anti-virus, Antispyware

ok with two devices doing the majority of the work and a dual core cpu you will get about 250-300 megabits/sec MAX with ips on due to your high ghz intel cpu.  The only way to approach 500 megabit with ips on is more cores at 3.0 ghz or faster.  but no more than quad core so no i-7(ht gives you too many threads to push the cpu freq high enough to be effective). so i-5 only is what i would recommend.  also MINIMUM of 8 gigs of ram with 16 being my recommendation.   AND more simultaneous users.  You can get 500 megabits with a QC cpu at 3.0 ghz or faster and 3-4 simultaneous heavy traffic users.  each user will max out at 250-300 megabits though.  I have posted many in depth articles about snort on here..you will have to look them up as i am not going to post those dissertations again..:) Memory speed is not that important in your scenario..:)