Network Warrior

Chapter 26. PIX Firewall Configuration

In this chapter, I will explain how to configure the most common features of a PIX firewall. Examples will be based on the PIX 515, which uses the same commands as the entire PIX line, from the PIX 501 to the 535, and the Firewall Services Module (FWSM).

Tip

Slight differences do appear between models. For example, the PIX 501 and 506e cannot be installed in failover pairs, and the PIX 506e has only two interfaces, and cannot be expanded. The FWSM also operates differently in that it is a module and has no configurable physical interfaces.

PIX firewalls can be a bit confusing for people whose experience is with IOS-based devices. While there are similarities in the way the command-line interpreter works, there are some pretty interesting differences, too. One of my favorite features of the PIX OS is the fact that you can execute the show running-config command from within configuration mode. Recent versions of IOS allow similar functionality using the do command (do show run from within configuration mode), but using the command in the PIX is, in my opinion, more natural.

Interfaces and Priorities

Each interface in a PIX firewall must have a physical name, a logical name, a priority, and an IP address. Interfaces may also be configured for features such as speed and duplex mode.

On the PIX 515, the standard physical interfaces are E0 and E1, even though the interfaces support 100 Mbps Ethernet. An expansion card can be installed to add interfaces, ...