Many firewall vendors now provide support for multiple network cards, which is especially useful for creating multiple DMZs. Externally visible machines can be spread across these zones, and for each machine that falls under attack, the others remain protected. The second biggest job, after protection, is to make it as difficult as possible for intruders to cause damage. Protecting machines from each other does this job for you, and the DMZ is at the heart of this. It is important to lose the attitude that a firewall is all the protection you need.
Firewalls only block traffic types that they have been told about.
If traffic is technically legal, but ends with a system being breached, you can find yourself in serious trouble. We can't help but stress again and again how important it is to have some kind of goal in mind when security is considered. Spend the time looking at exactly what you want in the network, because once you've done it, the results will pay for themselves. Simple steps to watertight security Create a policy from the ground up. Concentrate on password strengths and how long they will be valid.