Document the packet filtering rules Document packet filtering rules so that anyone reading the documentation and configuration data is able to see how each filtering rule enforces its part of the firewall policy. Describe why each rule is included. Specifying the detailed rules that implement your firewall policy can be a very complex and time-consuming process. It is very common that several rules are required to achieve one integral function. Most commercial firewall products provide complex configuration managers and user interfaces for specifying rules.
Some products provide the capability to aggregate related sets of rules into groups.
This means that you can specify a rule and understand what it does from a network perspective, but you may still have little idea of the policy implications. In many current products, firewall system performance degrades as the number of filtering rules increases. This further contributes to obfuscating the rules from a policy perspective. Establishing and maintaining your understanding of the rules from both a policy viewpoint and a network viewpoint at the same time is very difficult. One strategy to address this complexity is to maintain your firewall policy and the rules that implement it in a policy language of your own design.