Problem solve Get help with specific problems with your technologies, process and projects.

PIX 501 firewall configuration - Firewall rules

Despite having a NAT translation, users still need permission to utilize port 80 for Web browsing.

These clients on the inside network have a NAT translation, but that doesn't necessarily mean that they are allowed access. They now need a rule to allow them to access the outside network (the Internet). That rule will also allow the return traffic to come back in.

To make a rule to allow these users port 80 (Web browsing), you would type this:

PIX1(config)# access-list outbound permit tcp any eq 80
PIX1(config)# access-group outbound in interface inside

Note that PIX access lists, unlike router access lists, use a normal subnet mask, not a wildcard mask.

With this access list, you have restricted the inside hosts to accessing Web servers only on the outside network (routers).

PIX firewall configuration

 Step 1: The basics
 Step 2: Guidelines
 Step 3: Configuration setup
 Step 4: PIX configuration
 Step 5: Network address translation
 Step 6: Firewall rules
 Step 7: Showing and saving configuration
David Davis
David Davis

About the author
David Davis (CCIE #9369, CWNA, MCSE, CISSP, Linux+, CEH) has been in the IT industry for 15 years. Currently, he manages a group of systems/network administrators for a privately owned retail company and authors IT-related material in his spare time. He has written more than 50 articles, eight practice tests and three video courses and has co-authored one book. His Web site is

This tip originally appeared on

Dig Deeper on Managed network security services

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.