PIX vs IOS Firewall

[robert.leung]

What are some major differences between Cisco PIX and an IOS firewall? Thanks in advance.

[thomas.chen]

The PIX and IOS firewall are similar in how they handle the traffic. The question you want to ask is “do I want to take a performance hit on my router to handle firewalling?” In small networks, the performance hit is negligible. In larger networks, it’s higher. I prefer to have a single machine (PIX) dedicated to firewalling and just let the router route.

[fjordan]

I agree with the previous reply and also found this white paper by Cisco as to when to specify

the PIX box vs the router with IOS firewall feature set.

http://www.cisco.com/warp/customer/cc/pd/rt/2600/prodlit/flrrr_ov.htm

My question is, for the NIMDA worm, Cisco came out with a paper on house to use NBAR on

the router to stom NIMDA attacks. They did the same for the Code Red virus. However I did not

see how to do this same thing on the PIX box. Do you udate some signature file on the PIX

box with new attack signatures for code red and NIMDA? Did they come out with these

signatures for the PIX as quickly as they did for the firewall feature set?