How does a firewall-1 rule work?

["Ivan Fox" <ifox100 () hotmail com>]

There is a firewall-1 rule allowing certain users accessing servers in DMZ
from internal network using client authentication method.  The users are
able to access all servers including inner firewall, but not the outer
firewall.

The firewall log indicates that the outer firewall dropped by the rule 30 at
12:05, and then accepted by rule 10 at 12:10.  The end-result is that there
is no connection.

Any pointers/comments/suggestions are welcome.

Ivan