These are the real issues. If you intend to connect your LAN to the Net, a firewall is not going to be enough. Relying solely on a firewall is a bad idea because new cracking techniques are always emerging. Vendors say yes, as long as they are properly configured. However, think about that statement for a moment.
Crackers can already scan behind a firewall and determine the services running there.
That is the first and most important step. It will not be long before firewalls get cracked, so be prepared. Try to think of it in terms of a path or a trajectory. For example, the Web server probably trusts one machine, which we'll call workstation1 . Your job is to prevent that worst-case scenario from becoming a disaster.