One of the shortcomings of LEM is that it can only have one interface into the network. The problem is that we have multiple networks that are separated physically; therefore, the ability for LEM to tap into each network for the absorption logs is highly desirable. The way around this is to have messages go through a firewall as the firewall creates the security boundary separating the networks. But, due to corporate policy, all permit and deny traffic that goes through the firewall must be logged. Essentially, for every log message sent, two logs are created. One by the end device and the other from the firewall.
