Firewall Penetration Testing:
http://www.wittys.com/files/mab/fwpentesting.html

[Tools]
traceroute -S -p53 (modified version)
firewalk
hping
icmpenum
isic
nmap