AAA PIX - Page 6

There are a few things to consider when working with PIX access lists. First, it is recommended that you do not use the access list command with the conduit and outbound commands. Technically, these commands will work together, however, the way these commands interact causes debugging issues. The conduit and outbound commands operate with two interfaces, while the access-list command applies only to a single interface. If you choose to ignore this warning, remember that the access list is checked first. The conduit and outbound commands are checked after the access-list command. Second, the masks used in the PIX access lists and the outbound command are subnet masks, not wildcard masks.

Additional Dual-DMZ Configuration Considerations
Notice that there is a nat 0 command associated with the accounting DMZ. A nat 0 command prevents any NAT or PAT from occurring. How could this be used to your advantage? Assuming that you do not use NAT and you assign nonroutable IP addresses to a DMZ, you can prevent anyone on the Internet from reaching this DMZ while still allowing the local LANs to reach the network. You can also provide additional protection when you are using routable IP addresses through the PIX. Whether or not you choose to use NAT on an interface does not really affect how that interface operates.

--
This concludes the configuration of the PIX Firewall, with the exception of VPNs. The remainder of this chapter covers VPNs, starting with Point-to-Point Tunneling Protocol (PPTP) and then moving on to IPSec VPNs.