Hi,
>  
> I wonder if there is any consideration for an IDS as part of the next
> version???

just like web proxy - this is not part of a firewall job. its trivial 
to set up a bridge network outside or inside the firewall and run
snort etc on that - or even connect the LAN port to a hub and just sniff
that (though a transparent bridge doesnt introduce a collision domain)

alan