Almost every Cisco ASA in the world runs the same outbound NAT rule: take everything coming from the inside subnets and translate it to the outside interface IP, port-mapped. That is dynamic Port Address Translation, and it is the
Site-to-site IPsec VPN on the Cisco ASA is the most common way to interconnect two offices, a branch and headquarters, or a corporate network and a cloud VPC. The ASA has supported it since the PIX days, and
Security levels are the single most distinctive feature of Cisco ASA configuration. Every ASA interface gets a numeric value from 0 (lowest trust, typically the internet) to 100 (highest trust, typically your inside LAN), and the default forwarding behavior between
ACLs on the Cisco ASA work the same as on IOS routers in spirit but with three differences that matter in practice: ASA ACLs are almost always applied inbound, they reference the real (untranslated) destination IP rather than the post-
Every packet that enters a Cisco ASA goes through a deterministic series of checks before it is forwarded, dropped, or handed to the VPN engine. Understanding that order is the difference between fixing an outage in two minutes and chasing
Network Address Translation on the Cisco ASA is the single most common source of "why does this not work" tickets. The reason is not that NAT is hard, it is that the ASA syntax changed substantially in software
If you only learn one Cisco ASA troubleshooting command, make it packet-tracer. It simulates a single hypothetical packet through every ASA decision point - existing-connection lookup, security check, NAT untranslate, ACL, NAT translate, route lookup, egress checks - and tells
OSPF has a lot of moving parts. The state machine. The LSA types. The area types and what each one filters. The exact words to type when adjacency is stuck in EXSTART. The PingLabz OSPF Field Reference puts all of
BGP has a lot of moving parts. The state machine. The 13-step path-selection algorithm. The dozen knobs that influence which path wins. The exact words to type when adjacency is stuck in OpenSent. The PingLabz BGP Field Reference
Configure GRE tunnels on Linux with ip tunnel add. Cisco-to-Linux interop, MTU, MSS clamping, IPsec, gretap (L2), and persistence with systemd-network
The field guide for GRE failures on Cisco IOS XE, rebuilt around a real CML capture of a recursive-routing flap. The %ADJ-5-PARENT looped chain that lands just before %TUN-5-RECURDOWN, the administrative distance comparison that causes it, and three fixes: a static /32, filtering the transport...
Multipoint GRE, NHRP, and IPsec combined to form DMVPN. The three phases, hub and spoke config for Phase 3, verification commands, and design tradeoff