If you are trying to audit your firewall, Nipper is a really nice start. If you are trying to test your firewall while in production + scan for vulnerabilities on your machines that are accessible, then start with eEye (http://www.eeye.com). There are others as well, but it depends on what you are scanning for. If you just want to do a port scan to see what is open, you can start with nmap or scanline [sl.exe], but make sure to do a slow scan because the firewall is pretty good about picking up on fast port scans and dropping those packets, which will result in a bad report.
-=Q
