AAA PIX - Page 2

outbound and apply Commands
Now that you have seen how AAA can limit outbound access through an interface, there is another way to control and limit access from a higher security level interface to a lower security level interface. This method uses PIX access lists configured with the outbound and apply commands. The first thing to remember about this type of PIX access list is that it operates in a totally different manner than a router's access list. If you are intimately familiar with router access lists, you might have a harder time accepting how PIX access lists work than those who are not so familiar with router access lists. The order of a router's access list is vitally important, because the first match will cause a rejection or acceptance. However, the PIX uses a best-fit mechanism for its access lists. This allows the administrator to deny whole ranges of IP addresses and then allow specific hosts through at a later date without having to rewrite the whole access list. The PIX access list is also neither a standard nor an extended access list, but rather a combination of the two forms.

Where a router uses two commands, access-list and access-group (or access-class), to define and apply an access list, the PIX uses the outbound and apply commands to define and apply an access list.

The full syntax of the outbound command follows:

 outbound list_id permit | deny ip_address 
   [ netmask [java | port[- port]]] [ protocol]

A description of the command parameters can be found in Table 4-4: outbound Command Parameters: