A firewall also requires initial and ongoing support. It must be installed, configured, administered, and maintained by someone with the requisite skills, experience, and responsibility. While such support requirements have many similarities to general system administration, the firewall security support requirements are typically unique. So let's assume the above issues have been dealt with. It is known exactly what the protected system is being defended against, a firewall product has been selected, and an administrator with sufficient skills has been identified.
Firewalls can have an impact on performance.
The typical firewall has to examine ALL of the network traffic passing through it. This takes time, i.e. processor power, and can have an adverse effect on network performance. As traffic levels grow, or the complexity of the firewall's traffic analysis changes this impact can increase. Firewalls can also impact functionality. If the above issues are ignored for the moment it is tempting to consider protecting many systems behind a common firewall as this would seem to give the most benefit for the costs involved.