| 10.1 |  | Access Control Lists and the PIX Security Appliance |
| 10.1.1 |  | Access Control List (ACL) |

| Support for ACLs on the PIX Security Appliance The previous module discussed how the conduit and static commands could be used to allow traffic arriving at a PIX Security Appliance to flow from a lower security network to a higher security network. While this solution is effective, there is another solution that will also work, and that is using ACLs. This solution is illustrated in Figure .

One of the primary advantages of using ACLs instead of conduits when configuring a PIX Security Appliance is that they are configured in almost the exact same manner as they are for Cisco routers. This means that a network administrator who is already familiar with how to the configure ACLs on routers can now apply that knowledge to the PIX Security Appliance as well. As a result, Cisco now recommends using ACLs in place of conduits on the PIX Security Appliance.

ACL usage guidelines
When configuring ACLs on the PIX Security Appliance to permit and deny traffic, there are certain basic principles and guidelines that a network administrator should follow :

- Higher security area to lower security area
  - The ACL is used to restrict outbound traffic.
  - The source address argument of the ACL command is the actual address of the host or network.
- Lower security area to higher security area
  - The ACL is used to restrict inbound traffic.
  - The destination address argument of the ACL command is the translated global IP address.

Now that the guidelines for using ACLs on the PIX Security Appliance are clear, the course will examine how to configure ACLs on the PIX.