 be confusing because doing this creates a "trans- lation," even though nothing is being translated. The PIX must have a translation place for the hosts on the inside network to be able to connect to the hosts on the DMZ. The IP addresses do not need to be changed, but the path needs to be built. Once NAT is in place, all that's left to do is configure access lists to allow the required traffic from the DMZ to the inside network. Miscellaneous The following items are things that trip me up again and again in the field. Remote Access To be able to telnet or SSH to your PIX firewall, you must specify the networks from which you will do SO. This is done with the telnet and ssh commands: PIX(config)# telnet 192.168.1.0 255.255.255.0 inside PIX(config)# ssh 192.168.1.0 255.255.255.0 inside Saving Configuration Changes If you are in the habit of shortening the write memory command in IOS to wri, you will be frustrated to find that the abbreviation does not work on a PIX: PIX# wri Not enough arguments. Usage: write erase|floppy|mem/terminal|standby Chapter 26: PIX Firewall Configuration write net [<tftp_ip>]:<filename> PIX# wri mem Building configuration Cryptochecksum: f4f6sf4b 045a1327 1b4eaac1 670e1e41 The copy running startup command also does not work. When you're configuring the active PIX in a failover pair, each command should be sent to the standby PIX automatically after it's submitted, and when you save your changes on the active PIX, the write memory command should also write the configu- ration to the standby PIX. To force a save to the standby PIX, use the write standby command: PIX# write standby Building configuration PIX# Sync Started Sync Completed Note that the Sync Started entry above is not a command, but rather the output of normal PIX logging when logging is enabled. Logging If you have a firewall in place, you should save and periodically review the logs it gen- erates. When configured for logging, PIX firewalls create a great deal of information. Even on small networks, the logs can be substanti