Implicit Rules - Cisco PIX 520 - PIX Firewall 520 Online Help Manual

should permit or block a connection from a network or host on one interface to another network or host on
a different interface. Access rules are grouped by the interface on which they are configured and enforced.
Within each group, access rules are evaluated in the same order as you configured them. This is the default
method the PIX Device Manager will use to permit or block traffic.

Implicit Rules

Implicit rules are created when you create
tab. By creating address translation rules, the user implicitly permits some hosts to reach other hosts. Creating
static or dynamic translation rules will permit hosts on high-security interfaces to initiate connections with hosts
on lower security interfaces, even though no explicit access rules, such as ACLs, conduits, or outbound rules have
been created.
Note: Hosts cannot contact hosts on other interfaces unless either
been created.
Field Descriptions
There are three rule types on the Access Rules tab:
Access Rules—Govern which hosts can communicate with other hosts using protocols and services.
AAA Rules—Govern which connections between which hosts will be subjected to authentication,
authorization, or accounting.
Filter Rules—Govern which connections between which hosts will be subjected to content or URL
filtering.
Show Detail and Show Summary
Show Detail—Shows which hosts are capable of communication with other hosts using protocols and
services. Example.
Show Summary—Shows rules in a format similar to CLI, which is similar to the information entered in
the dialog boxes. Example.
Access Rules
The Access Rules option displays the following fields:
#—A number indicating order of evaluation for the rule.
Action—Indicates the action that applies to the given rule type. The rule will either be permitted or denied.
Source Name/Address—Displays the IP addresses that are permitted to initiate traffic to the IP addresses
listed in the Destination Name/Address column. An address column may contain an interface name with
the word any, such as inside:any. This means that any visible host on the inside interface is affected by the
rule. For high security interfaces, visibility is controlled by NAT rules.
Destination Name/Address—Displays the IP addresses that are permitted to initiate traffic to the IP
addresses listed in the Source Name/Address column.
Note: An address column may contain an IP address something such as the following:
[209.165.201.1-209.165.201.30]. This is a NAT global address pool, indicated by the square brackets. A
NAT rules on the Translation Rules tab or on the Hosts/Networks
static or dynamic NAT translation rules have