Translating every line will be tedious but this is how you read them
access-list [Name_of_ACL] [permit_or_deny] [tcp/udp] [Source] [destination] eq [Service]
The [Name_of_ACL] is anything you want - should tell you where it is applied or what it is intended to do.
The [permit_or_deny] tells you whether to allow the traffic or block it.
The [tcp/udp] says whether it is TCP or UDP traffic.
The [Source] is where the traffic originated. It could be a single IP with the "host" keyword in front. It could be a network with a subnet mask - 172.16.1.0 255.255.255.0. Or it could be "any" meaning that it doesn't care where the traffic originated - usually to the outside interface from the internet if you are providing services.
The [destination] is the same format as the source but it tells you where th traffic is destined. So internet traffic to the PIX would have this set as the PIX's IP. Traffic from the internal network may have this set to a specific web site's IP so that you could block ebay.com.
The [Service] tells you what service is the port number or service is -
https (443), smtp (25), etc. So you could only allow
HTTPS to an internal server and not allow SMTP from your internal network except for a trusted mail server.
Now in the ACL you can use object-groups. These group services, IPs, or networks together so you can limit what you need to type for the ACL. So you may have a cluster of mail servers that you want to allow SMTP out of but not let eny other computer send mail from your internal network. You would use an object-group to list those servers and then only have one line in the ACL.
ACL's are applied to interfaces and filter traffic coming
into that interface only. There will be lines after the NAT statements that say "access-group [ACL_name} in interface [interface_name]" these tell you what ACL is controlling the traffic entering that interface.
Now lastly the statics. They map an external IP (and possibly service) to an internal IP (and possibly service.)
static (inside,outside) [external_IP] [internal_IP]
Adding the service is optional and without it all traffic sent to the external IP will be processed for the internal IP unless it is blocked by the ACL.
There are a more options and a lot more complicated ways to set things up but this is the basic. If this didn't really help, try loading the PDM. It is a GUI interface to the PIX that might make a little more sense. Just open a web browser to the PIX internal IP. You didn't post that part of the config but most people set it up. If it isn't up, it is any easy addition.
All config examples
Brent
Systems Engineer / Consultant
CCNP, CCSP
