  The existence of errors or inconsistencies in the configuration of security
components, such as filtering routers and/or firewalls, may lead to weak access
control policies -- potentially easy to be evaded by unauthorized parties. We
present in this paper a proposal to create, manage, and deploy consistent
policies in those components in an efficient way. To do so, we combine two main
approaches. The first approach is the use of an aggregation mechanism that
yields consistent configurations or signals inconsistencies. Through this
mechanism we can fold existing policies of a given system and create a
consistent and global set of access control rules -- easy to maintain and
manage by using a single syntax. The second approach is the use of a refinement
mechanism that guarantees the proper deployment of such a global set of rules
into the system, yet free of inconsistencies.
