You will also want to routinely monitor logs. A unmonitored firewall is like a castle gate without guards. If attackers are given time, it is more likely they can break down the castle gate or, in this case, find a vulnerability you may have left when configuring the system. Vendors do not offer guarantees that their products will never be penetrated. You must pay attention to logs and watch for unusual activity.
Some products feature a powerful array of reducing scripts for logs.
Interlock from ANS of Reston, VA, can produce usage summaries detailed enough for charging internal users for the Internet connection. You don't want alarms going off in a wiring closet either. ANS, Checkpoint, Digital, Harris, IBM, Raptor, Secure Computing and TIS are among the vendors who support pager activation. Flexible alarm capabilities are a must for firewall products. This is another area where router-based packet filters are weak, in that they require a separate host and custom software to generate alarms.