Rule Base Logic - Any Good Books

[sisu-up]

I have some new firewall admins who don't understand why a rule like this

Rule SRC DST SERV
10 10.1.1.0 ANY ANY
10 10.2.2.0 ANY ANY

Would allow traffic from 10.2.2.0 to 10.1.1.0 when they are not blocking 10.2.2.0 to 10.1.1.0 above in the rule base. The log clearly shows why, but they still aren't seeing it.

So I'm looking for a book (or anything else) that can *really* address building rule bases and the logic of how it all works so they read up on it.

Anyone have a idea?

Thanks!