[phreenet]

Ultra paranioa indeed, I was always taught that you should only need one Firewall for your network and that is the firewall that sits between your WAN connection and your router or your router and your first switch, depending on the circumstances. Having firewalls inside your network is pointless, if you are worried about users doing stuff from the inside just setup Access List and VLANs, and then proceed to beat them ruthlessly as needed.