So while RA=2 on our internal network simply woruldn't fly (too many things would break) in the DMZ it is jes fine. Now that is a weak example, but you get my point.

We have a 3COM Superstack 3 Firewall. Three physical interfaces...WAN, LAN, DMZ. We also have it running a site-to-site vpn with a PIX on the remote end. That was pretty easy to set up.