When ASA security contexts share a physical interface, the classifier decides which context owns each incoming packet before any policy applies. Learn the classification rules that keep multi-tenant traffic out of the wrong tenant.
Active/Active failover needs multiple context mode and invites asymmetric routing. Watch a real ASAv 9.24 refuse the mode, then see the capture that proves what you should be running instead for most deployments.
How EtherChannel bundles ASA links into one pipe with LACP, and how it interacts with failover. Includes a real-lab reality check: the ASAv 9.24 parser rejects every Port-channel command, and we show you exactly where.
ASA redundant interfaces bundle two physical ports into one logical interface for fast link-level HA without full unit failover. We tried it on a real ASAv 9.24, the parser refused, and that rejection is the most useful part of this post.
Since ASA 8.3, interface ACLs reference the real, post-translation IP, never the mapped one. A before-and-after on one flow, allowed with a real-IP rule and dropped with a mapped-IP rule, settles the most misunderstood ASA behavior.
ASA NAT stops being a guessing game once you can read the NAT table: three sections, top to bottom, first match wins. This guide shows you the table in one command and how to predict which rule translates a packet.
Identity NAT is the ASA rule whose whole job is to not translate. You build a static identity NAT between an inside network and a DMZ on a live ASAv, then prove it changes nothing with show nat detail and packet-tracer.
Publish a private server through a Cisco ASA with destination NAT: the static object NAT config that maps a public address inbound, plus the exact order the ASA processes the packet on the way in.
Configure SSH, HTTPS, SNMPv3, NTP, and syslog on the Cisco ASA the secure way. Every capture is real, taken over SSH from a Linux host to an ASAv 9.24(1) running in Cisco Modeling Labs.
RIPv2 still shows up at interop boundaries, so here is how it behaves on a Cisco ASA. Two real captures from an ASAv 9.24 peering with IOS XE show it authenticating loudly and almost never winning a route.
Full EIGRP build on the Cisco ASA captured live from an ASAv 9.24, from working adjacency to the number-one neighbor failure that produces no error, no log, just an empty neighbor table.
The full OSPF build on a Cisco ASA: configuration, a verified adjacency with MD5 authentication, the DR/BDR election the firewall loses, the link-state database, and redistribution, all captured from a live ASAv 9.24.