| 10.1 |  | Access Control Lists and the PIX Security Appliance |
| 10.1.4 |  | ACLs versus conduits |

| As stated earlier, Cisco recommends using ACLs rather than conduits in PIX Security Appliance configurations. This is for future compatibility and greater ease of use for those familiar with Cisco IOS access control. The access-list command in the PIX Security Appliance uses the same syntax as the Cisco IOS access-list command with one very important difference. The subnet mask in the PIX access-list command is specified the same way as in all other PIX Security Appliance commands. This is very different from the Cisco IOS version of the command.

Whether configuring a PIX Security Appliance for the first time or converting from conduits to ACLs, it is important to understand the similarities and differences in the two commands. Probably the most important similarity is that either can be combined with a static command to permit or deny connections from outside the PIX Security Appliance to access TCP/UDP services on hosts inside the network. More specifically, they can both be used to permit or deny connections from a lower security interface to a higher security interface. There are, however, several very important differences. These include the following:

- A conduit operates from one interface to another, whereas the access-list command used with the access-group command applies only to a single interface. A conduit defines the traffic that can flow between two interfaces while an ACL affects all traffic entering the interface to which it is applied. ACLs have an implicit deny at the end of the list. Once an ACL is applied to an interface, packets inbound to that interface must follow the rules of the ACL regardless of the interface security level.
- The access-list command only controls access if used in conjunction with another command, the access-group command, which binds it to an interface. Conduits, however, are not bound to an interface.
- The access-list and access-group command statements take precedence over the conduit command statements.
- ACLs are somewhat more flexible than conduits. They can be used to restrict connections from a higher security interface to a lower security interface as well as permit or deny connections from a lower security interface to a higher security interface.