| 10.1 |  | Access Control Lists and the PIX Security Appliance |
| 10.1.2 |  | Configuring ACLs |

| The actual configuration of the ACL on a PIX Security Appliance is relatively simple. It is implemented using two commands, the access-list command and the access-group command. - The access-list command is used to create an ACL, and the access-group command applies the ACL to the specific interface on the router or PIX Security Appliance that will use it to filter traffic. Keep in mind that only one ACL can be bound to an interface at a time using the access-group command. PIX ACLs differ from ACLs on Cisco IOS routers in that the PIX does not use a wildcard mask like Cisco IOS. It uses a regular subnet mask in the ACL definition. As with Cisco IOS routers, the PIX ACL has an implicit "deny all" at the end of the ACL.

These commands are examined as part of the Command Reference for this module. Look at these commands and their various capabilities as well as the nat 0 access-list command, which allows an ACL to define traffic that is to be excluded from the NAT process.

It is important to realize that there is more to configuring ACLs on the PIX Security Appliance than simply creating and applying the configuration. ACLs are a powerful tool that can create many network issues if the network administrator does not plan their use well. Before the administrator can begin to configure an ACL on a PIX Security Appliance, it is necessary to have a thorough understanding of the traffic that will be filtered and the user requirements of the network. If the appropriate preparation is not done, it is extremely easy to accidentally disallow business-critical traffic.

Use the following guidelines for specifying a source, local, or destination address:

- Use a 32-bit quantity in four-part, dotted-decimal format.
- Use the keyword any as an abbreviation for an address and mask of 0.0.0.0 0.0.0.0. This keyword is normally not recommended for use with IPSec.
- Use host address as an abbreviation for a mask of 255.255.255.255.

Use the following guidelines for specifying a network mask:

- Do not specify a mask if the address is for a host; if the destination address is for a host, use the host parameter before the address. For example:

> access-list acl_grp permit tcp any host 192.168.1.1

- If the address is a network address, specify the mask as a 32-bit quantity in four-part, dotted-decimal format. Place zeros in the bit positions that should be ignored.
- Remember that a user specifies a network mask differently than with the Cisco IOS software access-list command. With PIX Firewall, use 255.0.0.0 for a Class A address, 255.255.0.0 for a Class B address, and 255.255.255.0 for a Class C address. If using a subnetted network address, use the appropriate network mask. For example:

> access-list acl_grp permit tcp any 209.165.201.0 255.255.255.224

| Lab Activity Lab Exercise: Configure ACLs in the PIX Security Appliance In this lab exercise, students will disable the ping command to an interface. Students will also configure inbound and outbound ACLs as well as configure malicious active code filtering.