| 8.4 |  | Routing and Multicast Configuration |
| 8.4.1 |  | Static routes |

| Although the PIX Security Appliance is not a router, it does have certain routing capabilities. This section will look at how the PIX Security Appliance routes traffic statically and dynamically. It will then discuss the PIX Security Appliance support of multicast routing. Finally, it will look at ways to verify and troubleshoot routing on the PIX Security Appliance.

The route command can be used to create static routes for accessing networks outside a router on any interface. The effect of a static route is similar to stating, “To send a packet to the specified network, send it to this router.” In the example in Figure , the PIX Security Appliance sends all packets destined to the 10.1.1.0 network to the router at 10.0.0.3. All traffic for which the PIX Security Appliance has no route is sent to 192.168.0.1, which is the gateway for the default route. To enter a default route, set the ip address and netmask arguments to 0.0.0.0 or the shortened form of 0. Only one default route can be used.

All routes entered using the route command are stored in the configuration when it is saved. They can be displayed by using the show route command, and using the clear route command can clear most routes. The only routes not removed with the clear route command are those that display the keyword CONNECT . These are routes that the PIX Security Appliance automatically creates in its routing table when an IP address is entered for a PIX Security Appliance interface. A route in this manner is a route to the network directly connected to that interface. Figure shows examples of these automatically created routes.

Although the gateway argument in the route command usually specifies the IP address of the gateway router, which is the next hop address for this route, the user can also specify one of the PIX Firewall interfaces. When a route command statement uses the IP address of one of the PIX Security Appliance interfaces as the gateway IP address, the PIX Security Appliance broadcasts an Address Resolution Protocol (ARP) request for a MAC address corresponding to the destination IP address in the packet. This is instead of broadcasting the ARP request for the MAC address corresponding to the gateway IP address. The following steps show how the PIX Security Appliance handles routing:

1. The PIX Security Appliance receives a packet from the inside interface destined to IP address X.
2. Because a default route is set to an interface, the PIX Firewall sends out an ARP for address X.
3. Any Cisco router on the outside interface LAN that has a route to address X replies back to the PIX Security Appliance with its own MAC address as the next hop. Cisco IOS software has proxy ARP enabled by default.
4. The PIX Security Appliance sends the packet to router.
5. The PIX Security Appliance adds the entry to its ARP cache for IP address X with the MAC address being that of the router.