| 15.7 |  | Enterprise PIX Management |
| 15.7.2 |  | Key concepts |

| Understanding the key concepts of the PIX MC will help maximize functionality. Configuration Hierarchy - The PIX MC provides a way to group PIX Security Appliances that have similar attributes, such as common rules and settings:

- The Global group contains all groups, subgroups, and devices.
- Groups contain one or more subgroups or devices.
- Devices are individual device units that can be listed only once in the configuration hierarchy.
- A device cannot be a member of more than one group.

Configuration Elements - The PIX MC allows configuration of four types of elements:

- Settings - Configuration elements that control individual features of a PIX Security Appliance, such as interface configuration.
- Access Rules - Access rules are recognized in the form of an ordered list, which is represented in the PIX MC as a table.
- Mandatory - Rules that apply at an enclosing group and are ordered down to a device. Mandatory rules cannot be overridden.
- Default - Rules that apply to all devices in a group but can be overridden.
- Translation Rules - Allows administrator to view the address translation rules applied to the network.
- Building Blocks - Allows administrator to associate a name with one or more values, for example to name a subnet in the network. Building block names can be used in place of corresponding data values in settings and rules.
- Workflow Process - Allows separation of responsibility for defining, implementing, and deploying firewall configurations.
- Defining an activity - A collection of policy changes typically made for a single purpose.
- Defining a job - A set of configuration files to be deployed to devices, configuration files, or an Auto Update Server (AUS). After a job is defined, it can be submitted for approval.
- Deploying a job - After a job is approved, the final stage is to deploy the job. This downloads configuration files to specified devices on the network, saves them as files, or sends them to an AUS.