The PIX and ASA firewalls are powerful tools for protecting the enterprise s internal network and its DMZ. Built on a purpose-built operating system, the PIX and ASA firewall appliances can provide the security, performance, resiliency, and flexibility to meet all your DMZ infrastructure needs. Five PIX and four ASA firewall models can provide network architects with several different options to meet their needs from a small DMZ environment to service provider-class environments.This chapter discussed several popular DMZ designs that will meet the needs of many DMZ planners. Use these designs to create the DMZ that best fits your requirements. Remember to choose your design based on your technical requirements and financial constraints.The PIX/ASA operating system is purpose-built and packed with features, which makes the PIX/ASA highly secure but at the same time provides many of the features found in firewalls based on general operating systems.

The PIX/ASA can be configured via a Web-based configuration and management tool called the Adaptive Security Device Manager (or, for the 6. x OS, the PIX Device Manager, or PDM) or via a command-line interface. In managing the PIX/ASA, always use a secure form of communication, such as SSH, which encrypts traffic between the client and the PIX/ASA, instead of Telnet, which communicates in clear text.This makes the PIX/ASA easy to configure and manage for both the novice and the advanced firewall administrator.

We covered how to configure many of the PIX/ASA s basic functions, including defining interfaces, NAT/PAT, access rules, and routing, which are essential...