On The Modular Verification And Design Of Firewalls