| 9.6 |  | Multiple Interfaces on the PIX Security Appliance |
| 9.6.2 |  | Configuring three interfaces on a PIX Security Appliance |

| A third interface is configured as shown in Figure . When the PIX Security Appliance is equipped with three or more interfaces, use the following guidelines to configure it while employing NAT:

- The outside interface cannot be renamed or given a different security level.
- An interface is always outside with respect to another interface that has a higher security level. Packets cannot flow between interfaces that have the same security level.
- A single default route statement should be used to the outside interface only. Set the default route with the route command.
- The nat command should be used to let users on the respective interfaces start outbound connections. Associate the nat_id with the global_id in the global command statement. The valid identification number can be any positive number up to two billion.
- After completing a configuration in which there has been an add, change, or remove to a global statement, save the configuration and enter the clear xlate command so that the IP addresses will be updated in the translation table.
- To permit access to servers on protected networks, use the static and conduit commands.

The figure provides a sample configuration of a PIX Security Appliance with three interfaces, inside, outside, and dmz, configured.

| Lab Activity e-Lab Activity: Configure the PIX Security Appliance In this activity, the student will practice configuring three interfaces on the PIX Security Appliance.