Let me say it up front: managing a firewall of any decent complexityis hard. Sooner or later you start losing track of rules and what'sactually going on, writing half-redundant rules, and so on; inshort, your firewall ruleset descends into sysadmin superstition .I've recently realized that part of why this happens is that there arethree views of your firewall's behavior that you need, and you can't getall of them just from reading your firewall rules; at most

Just like users have folklore , system administrationdoes too. Our sort of superstition is a bit different, though ( well , usually ):it is the kind of thing where you say 'I don't know why that's there,but let's not remove it just in case'. When our system environmentsreach a certain level of fragile complexity and westart losing track of the fine details, of course our informed actionsstart descending into rote procedures.

(This really accelerates when new people come