to interfaces with lower priorities, but interfaces with lower priorities cannot send packets to interfaces with higher priorities. An interface's priority is represented by an integer within the range of 0-100. The default priority for the inside interface is 100. The default priority for the outside interface is 0. If you add a third interface, its priority will typically be somewhere between these values (PIX os v7.0 introduced the ability to configure multiple inter- faces with the same priority). Figure 26-1 shows a typical PIX firewall with three interfaces: outside and inside interfaces, and a DMZ. E0-outside Priority-0 Least secure E2-DMZ Priority-50 Most secure E0-inside Priority-100 Figure 26-1. PIX firewall priorities Given this design, by default, traffic may flow in the following ways: From inside to outside. From inside to the DMZ. From the DMZ to the outside, but not to the inside. Traffic from outside may not flow to any other interface. The command to configure the name and priority of an interface is nameif. For example: PIX(config)# nameif etherneto outside security0 PIX(config)# nameif ethernet1 inside security100 These commands are the default configuration for a PIX firewall with Ethernet inter- faces. To configure the third interface in Figure 26-1, you would use the following command: PIX(config)# nameif ethernet2 DMZ security50 Chapter 26: PIX Firewall Configuration To configure the speeds and duplex modes of the interfaces, use the interface command: (config)# interface etherneto auto PIX(config)# interface ethernet1 100full Notice that even though the inside interface's name is ethernet1, it's configured for 100 Mbps. In an IOS router or switch, an interface capable of 100 Mbps would be named FastEthernet1. PIX firewalls do not run IOS, though, SO try not to assume anything based on your knowledge of IOS. To show the statuses of your interfaces, use the show interface command. The output of this command is similar to that produced in IOS: PIX# sho int interface etherneto "outside" is up