Identity NAT is the ASA rule whose whole job is to not translate. You build a static identity NAT between an inside network and a DMZ on a live ASAv, then prove it changes nothing with show nat detail and packet-tracer.
Publish a private server through a Cisco ASA with destination NAT: the static object NAT config that maps a public address inbound, plus the exact order the ASA processes the packet on the way in.
Configure SSH, HTTPS, SNMPv3, NTP, and syslog on the Cisco ASA the secure way. Every capture is real, taken over SSH from a Linux host to an ASAv 9.24(1) running in Cisco Modeling Labs.
RIPv2 still shows up at interop boundaries, so here is how it behaves on a Cisco ASA. Two real captures from an ASAv 9.24 peering with IOS XE show it authenticating loudly and almost never winning a route.
Full EIGRP build on the Cisco ASA captured live from an ASAv 9.24, from working adjacency to the number-one neighbor failure that produces no error, no log, just an empty neighbor table.
The full OSPF build on a Cisco ASA: configuration, a verified adjacency with MD5 authentication, the DR/BDR election the firewall loses, the link-state database, and redistribution, all captured from a live ASAv 9.24.
The ASA supports OSPF, EIGRP, RIP, and BGP, but with different defaults and its own opinions about which routes it installs. Get oriented with live captures from an ASAv 9.24 in CML before you configure any of them.
COOP key servers fix the GETVPN control plane, but there is a trap: mismatched RSA rekey keys pass every failover test and then kill the group at the next rekey. We hit it on purpose.
FVRF routes the tunnel's outer ESP packets; IVRF holds the decrypted inner traffic. Separate those two in your head and VRF-aware IPsec becomes bookkeeping. This guide builds the config from that distinction.
The hands-on GETVPN build on Cisco IOS XE. Key server first, then group members (nine lines, no peer, no ACL), then verification. Every command verified on cat8000v 17.18.02.
Pre-shared keys sit in plain sight in configs and backups and do not scale past a few peers. This article moves IPsec authentication to certificates: trustpoints, CA enrollment, and revocation, so each device holds its own key and enrolls once.
GETVPN is the one VPN with no tunnels and no peers. Every site shares one group key. Real IOS XE captures prove it, including the packet capture that explains why GETVPN cannot cross the internet.