It is known exactly what the protected system is being defended against, a firewall product has been selected, and an administrator with sufficient skills has been identified. Firewalls can have an impact on performance. The typical firewall has to examine ALL of the network traffic passing through it. This takes time, i.e. processor power, and can have an adverse effect on network performance. As traffic levels grow, or the complexity of the firewall's traffic analysis changes this impact can increase.
Firewalls can also impact functionality.
If the above issues are ignored for the moment it is tempting to consider protecting many systems behind a common firewall as this would seem to give the most benefit for the costs involved. In reality this usually just makes the firewall based problems even worse. Protecting one type of system from a problem may have unexpected side effects on access to dissimilar systems. Performance issues are compounded too as much more traffic flows through the firewall. This type of deployment also introduces a new single point of failure which could have a broad impact should something go wrong with the firewall.