| 10.2 |  | Using ACLs |
| 10.2.2 |  | Permitting web access to the DMZ |

| Permitting Web access to the DMZ E-commerce has become increasingly important to businesses over the past decade. However, in order for e-commerce to function effectively, hosts on the outside network must be able to access a company Web server, which typically resides on a DMZ. By default, the PIX Security Appliance does not allow access to the higher security DMZ network from the lower security outside network. Therefore, in order to allow outside users access to a company Website, an ACL must be configured on the PIX.

Figure illustrates the ACL, named acl_in_dmz , being applied to the outside interface in order to filter inbound traffic. The ACL permits Web connections from the Internet to a public Internet Web server. All other IP traffic is denied access to the DMZ or inside networks. Furthermore, because the DMZ is separated from the internal network, no additional security risks are created for the internal network.