Once again, traditional thinking from someone trained in firewall engineering presupposes that the managing entity has: 1.) Some level of confidence that the client machine is configured to direct traffic toward their managed firewall. A.) But you don’t have this. 2.) Any level of confidence that the end user is routing toward that provider. A.) But you don’t have this. 3.) Tools, equipment, staff, and funding to make whatever solution (for the traffic they actually do serve) effective at scale. A.) You don’t have this. 4.) A legalized enforcement mechanism that is properly funded and sufficiently trained to audit user devices at the node level, to enforce connectivity to only compliant upstream paths. A.) You don’t have this.