One solution could be an old decommissioned branded box. The 3100 and 3200 sell on eBay for maybe $150 in the US. They have mostly-permanent licenses associated with the MAC address of the system.
The risk is that the license may no longer work. An old box can be "traded in" for a slight discount on a new purchase. When this happens, the old box's license is invalidated.
Note that this doesn't include subscriptions, which means no IPS updates, no URL categorization, no antivirus, etc. As long as you get a box with a license, you can use firewall, VPN, network management, logs, identity awareness, SNX, and clustering/dynamic routing perpetually.