Introduction

There are many ways to design and build your DMZ, and with so many products on the market, it might be difficult to decide which product is right for you. In the next few chapters we discuss several enterprise-level firewall solutions, including Cisco s PIX and ASA, Check Point s FireWall-1, and Microsoft s ISA 2004. We provide the information you need so that you can decide which firewall meets your DMZ needs in terms of security, performance, functionality, manageability, stability, and reliability. Although all these products provide viable security solutions, they all have different requirements, features, and configuration methods that could lead you to choose one over the other. It is important to understand these products capabilities and choose the one that meets your DMZ infrastructure performance needs and maintains a high level of security, one that you are comfortable supporting.

Reading this chapter, you will learn how to design and build a DMZ using Cisco s PIX and ASA firewalls. We will advise you on the features of the PIX and the ASA, guide you in the selection of the appropriate PIX and ASA hardware, and discuss different firewall arrangements, as well as direct you on how to configure your firewall to securely pass traffic. By the end of this chapter you should be able to decide whether the PIX or ASA is the right firewall for your DMZ infrastructure and, if you choose it, be able configure, manage, and support the PIX and ASA.