|  |  | Another feature of the CiscoSecure PIX Firewall is the cut-through proxy. Traditional UNIX-based firewalls provide authentication for users and maintain it at the expense of performance. The PIX performs the initial challenge to the user at the application layer. Once authenticated via TACACS+ or Radius, the session flow shifts to a direct transfer of packets between the host and client, all the while maintaining session state.