Object groups collapse a 36-line ASA ACL to one line and turn subnets, hosts, and pools into named objects you reference everywhere. Covers the four object-group types, nesting, and real show output from the lab's running OUTSIDE_IN ACL.
ASA interfaces differ from IOS in two ways that matter: every data interface needs nameif and security-level, and there is no DTP, so 802.1Q trunks are built purely from subinterfaces. Covers physical interfaces, subinterfaces, and trunks to a Catalyst.
Routed mode makes the ASA a Layer 3 hop; transparent mode makes it a Layer 2 bridge you can drop into an existing subnet without re-IP'ing anything. This article covers both modes, the config, and what breaks when you flip.
A field guide to the four most common ASA outage patterns: NAT pool exhaustion, ACL shadowing, a VPN up with no traffic, and failover split brain, each with the one show command that decides it.
show conn and show xlate answer almost every question about whether traffic is flowing through the ASA. This article walks both tables, the most useful filters, and the clear commands, with live output from ASAv 9.23(1).
Most ASP drops leave no syslog and no ACL hit, just a counter in show asp drop. This article decodes the common drop reasons and chains the counter with an asp-drop type capture to see the discarded packets, on a live ASAv 9.23.
The four ASA CLI capture modes you will use most: interface raw-data, ASP-drop, type asp-all, and match-filter, all with real output from a live ASAv 9.23(1). Capture proves whether the packet arrived and where the data plane dropped it.
Stateful failover replicates the ASA's connection table, xlate table, and ARP to the standby so in-flight sessions survive a unit failure. This post walks the configuration, the healthy sync output, and interface tracking.
Two identical ASAs, a dedicated failover link, and sub-second promotion when the active unit dies. Walk the full active/standby configuration, the show commands you read to verify it, and the gotchas that bite on real builds.
AnyConnect login failures come down to AAA or certificates. This guide maps each symptom to the exact show and debug command that confirms the cause, with output from a live ASAv 9.23(1) in the lab.
When an ASA IPsec tunnel will not come up, first identify whether Phase 1 or Phase 2 failed. This article shows the log messages and show output that point to each common cause, with real debugs from a deliberately broken tunnel on a live ASAv 9.23(1).
The full certificate lifecycle for AnyConnect on Cisco ASA 9.x: identity cert generation, CA enrollment, and client certificate authentication, plus the confusing ways each side fails when you get it wrong.