| 9.6 |  | Multiple Interfaces on the PIX Security Appliance |
| 9.6.1 |  | Additional interface support |

| Additional interface support on the PIX Security Appliance Depending upon the licensing and model, the PIX Security Appliance supports up to eight additional physical interfaces for platform extensibility and security policy enforcement on publicly accessible services. With version 6.3, the PIX can support virtual interfaces . The multiple perimeter interfaces enable the PIX Security Appliance to protect publicly accessible Web, Mail, and DNS servers on the DMZ. Web-based and traditional Electronic Data Interchange (EDI) applications that link vendors and customers are also more secure and scalable when implemented using a physically separate network. As the trend toward building these extranet and Partnernet applications accelerates, the PIX Security Appliance is already prepared to accommodate them.

Access through the PIX Security Appliance
When configuring multiple interfaces, remember that the security level designates whether an interface is inside, and trusted, or outside, and untrusted, relative to another interface. An interface is considered inside in relation to another interface if its security level is higher than the security level of the other interface. It is considered outside in relation to another interface if its security level is lower than the security level of the other interface .

The primary rule for security levels is that an interface with a higher security level can access an interface with a lower security level. The nat and global commands work together to enable the network to use any IP addressing scheme and to remain hidden from the external network.

An interface with a lower security level cannot access an interface with a higher security level unless specifically allowed by implementing static and conduit or static and access list command pairs.