 that should be followed, such as the ones I've outlined here, the needs of your business will ultimately determine how you deploy your firewalls. Chapter 25: Firewall Theory CHAPTER 26 PIX Firewall Configuration In this chapter, I will explain how to configure the most common features of a PIX firewall. Examples will be based on the PIX 515, which uses the same commands as the entire PIX line, from the PIX 501 to the 535, and the Firewall Services Module (FWSM). Slight differences do appear between models. For example, the PIX 501 and 506e cannot be installed in failover pairs, and the PIX 506e has only two interfaces, and cannot be expanded. The FWSM also operates differently in that it is a module and has no configurable physical interfaces. PIX firewalls can be a bit confusing for people whose experience is with IOS-based devices. While there are similarities in the way the command-line interpreter works, there are some pretty interesting differences, too. One of my favorite features of the PIX os is the fact that you can execute the show running-config command from within configuration mode. Recent versions of IOS allow similar functionality using the do command (do show run from within configuration mode), but using the command in the PIX is, in my opinion, more natural. Interfaces and Priorities Each interface in a PIX firewall must have a physical name, a logical name, a prior- ity, and an IP address. Interfaces may also be configured for features such as speed and duplex mode. On the PIX 515, the standard physical interfaces are E0 and E1, even though the interfaces support 100 Mbps Ethernet. An expansion card can be installed to add interfaces, which are numbered incrementally, starting at E2. Each interface must be assigned a logical name. The default names are inside for the E1 interface, and outside for the E0 interface. Each interface must also have a priority assigned. The priority establishes the level of security for the interface. By default, interfaces with higher priorities can send pack- ets 