Yes, stateful firewalls are almost as much of a blight on the Internet as NATs are. The way it's "supposed" to work is for security to be handled by the endpoi

Yes, stateful firewalls are almost as much of a blight on the Internet as NATs are. The way it's "supposed" to work is for security to be handled by the endpoints (e.g. the SIP hardware phone). But that's a totally unrealistic goal because it makes it very difficult to do centralized administration of security policies. It's also rather undesirable when mobile devices are involved (you would like to stop unauthorized traffic before it enters a wireless network where it wastes precious bandwidth and battery life). We're just going to have to live with the problem.