I see you too worried about the technical details, and not about the rest. As @Stephane posted, there is a need to identify what to protect when dealing with a firewall policy.
You have to identify what will influence your stance, and what level of security you need and will be able to enforce:
- Your control/operation network
Normally most of this network is not supposed to have any access from the normal network and much less from the outside. At most, it can communicate with a proxy to have access to software updates, and with the internal DNS servers.
- Servers providing service to the outside
This will be your corporate DNS, SMTP and proxies. They will have access to the outside.
- Servers being your presence on the Internet
WWW servers, or other services provided to the exterior. Only the needed services should be open.
- Your layers inside your organisation
From instance, in a university, the students quarters have much different requirements from professors networks.
- The more or less sensitive departments
HR, financials and operations, for instance, should be insulated from other networks. Some of these departments should also have a more restricted policy about using Internet.
- Internal politics
Some places just have a politics as providing full access to the Internet, while others for instance, define Internet will have full access outside work hours, while others may define other kind of restrictions.
- Your industry
For instance, in the Education industry it is expected to have the least restrictions, while in an ISP even less but with bandwidth caps, while in banking being very restrictive either in what gets in or what gets out.
However, even often there is a need to not get lost between the distinction [and separation] between the service for customers and the corporate network, where different cultures and rules will apply.
- Perceived acquired rights / resistance to change
There goes against saying that tradition and acquired rights will play a very strong role into what you can achieve.
- User expectations of service vs business needs
The balance between security, the needs/wants of users and quality of servce is always a delicate one, and compromises need to be made. For instance, in a very open environment the expectation to use p2p may not be met when it interferes with voip and http services.
- Law requirements
You may have to keep certain types of logs X time. You might need to cut several protocols, namely bittorrent (several firewalls of big players already come with DPI).
- Documentation and monitoring
All goes without saying to effectively establish a successful firewalling policy, there is a need to know what is happening inside the network and IF all is documented. Audit the service. A big name player will be more than happy to help if that nets a sale.
- Support of management
Finally, the process as to be fully supported by the upper management, and most of the decisions of what has to be allowed or cut have to be approved by them.
- Evolution/Restrictions of technology
Restrictions on costs, resources, and requests/needs will influence the decisions on all the above points, and the technology you will use.
Mostly in the fast-paced world of technology field, when focusing on the technical side, some of the strategies and decisions you may be using can be or will be shortly outdated. As an example, some vendors are trying to sell me solutions that soon will have impaired functionality due to the widespread proliferation of VPN/encryption for personal use, for instance.