In this chapter, I will explain how to configure the most common features of a PIX firewall. Examples will be based on the PIX 515, which uses the same commands as the entire PIX line, from the PIX 501 to the 535, and the Firewall Services Module (FWSM).
Slight differences do appear between models. For example, the PIX 501 and 506e cannot be installed in failover pairs, and the PIX 506e has only two interfaces, and cannot be expanded. The FWSM also operates differently in that it is a module and has no configurable physical interfaces.
PIX firewalls can be a bit confusing for people whose experience is with IOS-based
devices. While there are similarities in the way the command-line interpreter works, there
are some pretty interesting differences, too. One of my favorite features of the PIX OS is
the fact that you can execute the
command from within configuration mode. Recent versions of IOS allow similar functionality
do command (
run from within configuration mode), but using the command in the PIX is, in my
opinion, more natural.
Each interface in a PIX firewall must have a physical name, a logical name, a priority, and an IP address. Interfaces may also be configured for features such as speed and duplex mode.
On the PIX 515, the standard physical interfaces are E0 and E1, even though the interfaces support 100 Mbps Ethernet. An expansion card can be installed to add interfaces, ...