Watchgard is garbage. I can't rip that stuff out fast enough. Most times I'm able to do so, the people who own the gear won't let me give it the violent destruction it so richly deserves. Get rid of it, destroy it, make your life easier.
Anyway, I digress...
Cisco's Windows VPN client is the best by a lot. It's the most compatible client I've seen, and it gets things right like handling Windows login after the VPN connects. I can't strongly enough recommend the Cisco VPN client for Windows.
Head-ends are a bit trickier. The PIX 501/506E are cheap and get the job done at the low end, though they've got a lot of quirks. They're also now a dead platform. The Cisco VPN Concentrator series is interesting if you have a really huge budget, but if you have a really huge budget you also have a lot of other good options to consider (every vendor loves the customers with really huge budgets . In the middle, any router with IOS can run the firewall/IPsec image, but you really want a crypto accelerator too. And only a few of their accelerators support AES encryption, which I consider a mandatory feature in any new VPN purchase. The Cisco ISR 800/1800/2800/3800 series is the official Cisco answer to the problem, and they have good specs and good pricing. What they're bad at is QA, I've seen a whole lot of bugs on that platform that never ever should have made it out the door, and I'm not seeing Cisco make enough progress towards getting those boxes where they need to be. So the moral of this story is, with Cisco, you have to pick your pain on the head-end.
My personal experience is that I'd rather have my pain on the server side and the client side be smooth. One of those is a lot easier for me to debug, and there's a whole lot fewer of them to debug, too.