Rule base management is certainly a problem area for many firewall administrators. It's easy for firewall rule...
bases to become riddled with incorrect, overlapping and unused rules, even in the presence of a change management system. There has been a bit of academic research into this topic during the past few years, and researchers have identified a number of anomalies worthy of an administrator's attention:
There are a couple of commercial tools that attempt to tackle these problems, such as Secure Passage LLC's FireMon and Algorithimic Security (AlgoSec) Inc's Firewall Analyzer. The true solution, however, is to keep your rule base simple, limit it to a manageable size and conduct regular audits.