Application Example of the PIX Firewall

Settings:
Ethernet0 is named as the external interface outside, and the security level is 0.
Ethernet1 is named as the internal interface inside, with a security level of 100.
Ethernet2 is named as the intermediate interface DMZ and has a security level of 50.

Reference Configuration:
Pix525 # conf t; enter the Configuration Mode
Pix525 (config) # nameif ethernet0 outside security0
; Set full-level 0
Pix525 (config) # nameif ethernet1 inside security100
; Set the full-Level 100
Pix525 (config) # nameif ethernet2 DMZ security50
; Set the full-level 50
Pix525 (config) # interface ethernet0 auto; set the automatic mode
Pix525 (config) # interface ethernet1 100 full; set the full duplex mode
Pix525 (config) # interface ethernet2 100 full; set the full duplex mode
Pix525 (config) # IP Address outside 133.0.0.1 255.255.255.252
; Set the interface IP Address
Pix525 (config) # IP address inside 10.66.1.200 255.255.255.0.0
; Set the interface IP Address
Pix525 (config) # IP address DMZ 10.65.1.200 255.255.255.0.0
; Set the interface IP Address
Pix525 (config) # global (outside) 1 133.1.0.1-133.1.0.14
; Address pool defined
Pix525 (config) # NAT (inside) 1 0 0; 0 0 indicates all

Pix525 (config) # route outside 0 0 133.0.0.2; set the default route
Pix525 (config) # static (DMZ, outside) 133.1.0.1 10.65.1.101
; Static Nat
Pix525 (config) # static (DMZ, outside) 133.1.0.2 10.65.1.102
; Static Nat
Pix525 (config) # static (inside, DMZ) 10.66.1.200 10.66.1.200
; Static Nat
Pix525 (config) # access-list 101 permit IP any host 133.1.0.1 EQ WWW
; Set ACL
Pix525 (config) # access-list 101 permit IP any host 133.1.0.2 EQ FTP
; Set ACL
Pix525 (config) # access-list 101 deny ip any
; Set ACL
Pix525 (config) # accesskey-group 101 in interface outside
; Apply the ACL to the outside Port

When an internal host accesses an external host, it is converted to a public IP address through NAT to access the Internet.
When the internal host accesses the DMZ in the middle area, it maps itself to its own access server. Otherwise, the internal host will
Maps to the IP address of the address pool and finds it externally.
When the external host accesses the DMZ in the middle area, it maps 133.0.0.1 to 10.65.1.101, and static is bidirectional.
All ports of the PIX are disabled by default. The access to the PIX is filtered by the ACL entry.
Static Routing indicates that the internal host and DMZ data packets exit from the outside Port.