You might as well place alladin's E-safe to check all incoming data for validity. It checks all attachments, ActiveX/java/cgi/etc for funcionality and then push them back to the clients or servers. 

Nice little thing to have on your system.

Spiros

> Why do you say FW-1 does not do a good job at what it claims 
> to do?  It 
> seems to work as advertised from my lab and implementation 
> tests, that is, 
> hitting the gateway with nmap scans only turned up the services I 
> allowed.  Yes, it doesn't really inspect the http traffic or 
> smtp traffic, 
> but I don't think many people configure their ALGs to do that 
> either (but, 
> that's a separate debate).
> 
> Cheers!
> Jon