The deny-all strategy starts with a "block everything" approach with the firewall blocking all communication between the network and the rest of the world. As a second step the administrator then opens up address ranges or ports that are required for day-to-day communication with the Internet, etc.
This approach is better for the security of the LAN than the allow-all strategy but often leads to difficulties for users in the initial phase. Some things may simply not work in the same way after the deny-all firewall is activated and some computers may not be reachable, etc.
