Configure the interfaces

• First define the port settings (100 full/auto/etc),
• then name the interfaces, and set their security zones (100= secure, 0= dmz)
• Then define the mtu's for the interfaces
• And finally specify the IP's and masks for each interface.
  

Notes
for ip address settings, other then static ip's you can also set the interface to pickup an IP via dhcp, and can also set it to be the def route via the command
You'll also need to add a route statement like such:

route outside 0.0.0.0 0.0.0.0 198.18.0.1 1

Allow the Traffic:

Outbound PAT's

To allow (unestablished) traffic outbound you need to use the global and nat statements. 


In the global statement, the "interface" variable states that all outbound traffic will use the defined "outbound" interface IP for all oubound traffic.  (in this case 198.18.0.254)

In the nat statement, we are allowing all traffic from 198.18.2.0/24 into the "inside" interface, and let it go out any global interfaces bound to the "2" id.

Inbound NAT's

To allow the traffic inward, you need to allow the route with a static command, and then allow the traffic with what was the conduit command, but is now an ACL bound to an interface.  So for the following example, our outside pix interface has a vip ip of 198.18.0.30, and we want to allow web traffic to the webserver with the ip of 198.18.1.30.

! Allow outside to route to web 
static (web,outside) tcp 198.18.0.30 www 198.18.1.30 www netmask 255.255.255.255 0 0

! Define alias:
object-group service _PORTS-WWW_ tcp
  port-object eq www
  port-object eq https

! Define ACL
access-list world-in permit tcp any host 198.18.0.30 object-group _PORTS-WWW_
access-list world-in permit icmp any any


! Bind ACL to interface
access-group world-in in interface outside

The access-group binds the ACL "world-in" to the outside interface, with the vip 198.18.0.30.
The access-list is titled "world-in", and it allows any TCP source from the outside interface through with ports defined in the alias "_PORTS-WWW_"
The static command allows routes between the outside interface on vip 198.18.0.30 to the web interface on 198.18.1.30

The rules read this way:

         /----to domain
         |     /----from domain
         |     |      /--- proto
         |     |      |      /--- vip ip
         |     |      |      |        /---vip port
         |     |      |      |        |       /--- dest ip
         |     |      |      |        |       |       /---dest port
         |     |      |      |        |       |       |               /--- only 1 vip thus /32
         |     |      |      |        |       |       |               |
static (web,outside) tcp 198.18.0.30 www 198.18.1.30 www netmask 255.255.255.255 0 0

                /--- ACL name
                |                     /--- interface to apply acl on
     *          |     *    *          |
access-group world-in in interface outside

               /--- ACL Name
               |       /--- (permit/deny)
               |       |     /--- proto allowed
               |       |     |   /-- source address
               |       |     |   |               /--- dest vip ip
               |       |     |   |               |                   /--- dest port
               |       |     |   |               |                   |                             
access-list world-in permit tcp any host 198.18.0.30  object-group _PORTS-WWW_

Define General Standards:

References:

• Cisco's Pix Tech Notes: Lots of different examples and notes on how to config pixes.
• PixOS v6.3 Config Guide: Specific notes on v6.3
• Pix 500 Overview Page: