If it's a big network with lots of money a checkpoint firewall is in order - if it's on a small scale route it through a secure slack box running ipchains.

Your not going to stop a big DoS attack no matter what you buy - even with millions of dollars in equipment.