s don't work. The downside is that unless you have a documented security statement, you'll spend a lot of time arguing with people about what's allowed and what's not. The default behavior of many firewalls, including the Cisco PIX, is to allow all traffic outbound. Restricting outbound traffic may be a good idea based on your environment and corporate culture, though I've found that most small and medium-sized companies don't want the hassle. Additionally, many smaller companies don't have strict Internet usage policies, which can make enforcing outbound restrictions a challenge. Everything that's not yours belongs outside the firewall This is another simple rule that junior engineers often miss. Anything from another party that touches your network should be controlled by a firewall. Net- work links to other companies, including credit card verification services, should never be allowed without a firewall. The corollary to this rule is that everything of yours should be inside the firewall (or in the DMZ). The only devices that are regularly placed in such a way that the firewall cannot monitor them are VPN concentrators. VPN concentrators are often placed in parallel with firewalls. Everything else should be segregated with the firewall. Segregation can be accomplished with one or more DMZs. Firewalls get blamed for everything. It seems to be a law of corporate culture to blame the firewall the minute anything doesn't work. I believe there are two reasons for this. First, we naturally blame what we don't understand. Second, a firewall is designed to prevent traffic from flowing. When traffic isn't flowing, it makes sense to blame the firewall. The DMZ Firewalls often have what is commonly called a DMZ. DMZ stands for DeMilitarized Zone, which of course has nothing to do with computing. This is a military/political term referring to a zone created between opposing forces in which no military activ- ity is allowed. For example, a demilitarized zone was created between North and South Korea. In the realm of secur