¨Packets cannot traverse the PIX Firewall without a translation, connection, and state
¨Outbound connections (originating from higher security interface and destined to lower security interface) are allowed except those specifically denied by ACLs
¨Inbound connections are blocked except those specifically permitted
¨All ICMP packets are denied unless explicitly permitted
¨