Cisco ASA Cheat Sheet: Essential Commands for Network Administrators

When you are staring at a Cisco ASA under pressure - a tunnel is down, traffic is being dropped, or you are bringing up a new firewall - you do not want to hunt through documentation. This cheat sheet collects the ASA commands you actually reach for, grouped by task, with the ASA-specific tools (packet-tracer, show xlate, show conn, show nameif) that separate firewall troubleshooting from switch troubleshooting. Every command here is written the way it works on current ASA software; the version output below is from a real ASAv running 9.24(1).

(This article is part of the PingLabz Cisco ASA series - the full Cisco ASA guide maps the whole cluster in reading order.)

Version and System Basics

Start by confirming what you are actually logged into. On the ASA, privileged EXEC is where the useful output lives, so enable first.

ASA1> enable
Password: ********
ASA1# show version | include Version

Real output from the lab ASA:

Cisco Adaptive Security Appliance Software Version 9.24(1)
Compiled on Mon 01-Dec-25 23:05 GMT by fpbesprd

The other system commands you will use constantly:

show version                 ! software version, model, uptime, licensing
show running-config          ! the live config
show running-config nat      ! just the NAT section (do this, not the whole config)
write memory                 ! save running-config to startup
reload                       ! restart the appliance

On the ASA, show running-config can be long. Filter it with a section keyword (show running-config nat, show running-config access-list, show running-config interface) instead of scrolling the whole thing.

Interfaces, Security Levels and nameif

This is the first thing that trips up engineers coming from IOS. An ASA interface does almost nothing until it has a nameif (a logical name like inside or outside) and a security level. Traffic is permitted from a higher security level to a lower one by default, and denied the other way until an ACL allows it.

show nameif                  ! map physical interfaces to names + security levels
show interface ip brief      ! interface, IP, and up/down status
show interface               ! full counters and errors per interface

Configuring an interface end to end:

interface GigabitEthernet0/0
 nameif inside
 security-level 100
 ip address 10.10.10.1 255.255.255.0
 no shutdown

The show nameif table is the fastest way to answer "which interface is outside?" on a firewall you did not build. Check it before you touch a single ACL or NAT rule.

Access Control Lists

ASA ACLs are applied to an interface with access-group, and the direction matters. The classic mistake is a permissive rule on the outside interface. Do not do this:

! WRONG - opens every host behind the firewall to the internet on port 80
access-list OUTSIDE_IN extended permit tcp any any eq 80
access-group OUTSIDE_IN in interface outside

permit tcp any any eq 80 inbound on the outside interface lets anyone on the internet reach any inside host on port 80. An inbound outside ACL should permit only the specific published service on the specific translated address:

! Correct - permit only the web server's public address on 80/443
access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq www
access-list OUTSIDE_IN extended permit tcp any host 203.0.113.10 eq https
access-group OUTSIDE_IN in interface outside

The commands you use to read and manage ACLs:

show access-list              ! ACLs with hit counts per line
show access-list OUTSIDE_IN   ! just one ACL
clear access-list OUTSIDE_IN counters   ! reset the hit counters

The hit counts are the useful part: a rule with zero hits is either never matched (dead rule) or your traffic is not arriving. That single number answers most "is my ACL working?" questions.

NAT

ASA NAT is object-based. A dynamic PAT for inside users going out, and a static NAT to publish an inside server, look like this:

object network INSIDE-NET
 subnet 10.10.10.0 255.255.255.0
 nat (inside,outside) dynamic interface

object network WEB-SRV
 host 10.10.10.100
 nat (inside,outside) static 203.0.113.10

The commands that tell you whether NAT is actually happening:

show nat                      ! NAT rule table with translate/untranslate hit counts
show xlate                    ! the live translation table (who is mapped to what right now)
show running-config nat       ! the configured NAT rules

show xlate is the ASA equivalent of "show me the NAT translations" and is one of the first commands to run when inside hosts cannot reach the internet. No xlate entry for a flow means NAT never built a translation for it.

Connections and the Packet Path

These two commands are what make ASA troubleshooting different from a switch. show conn is the live connection table, and packet-tracer simulates a packet through the entire ASA pipeline (ACL, NAT, inspection, routing) and tells you exactly which phase would drop it.

show conn                      ! all active connections through the box
show conn address 10.10.10.100 ! connections involving one host

packet-tracer input inside tcp 10.10.10.100 1234 8.8.8.8 80

packet-tracer is the single most useful ASA troubleshooting tool. It walks a synthetic packet from the named interface through every phase and prints ALLOW or DROP with the reason and the rule that decided it, without you needing real traffic. Learn this one command and most "why is this being blocked?" tickets answer themselves.

VPN Status

For site-to-site and remote-access tunnels, the status commands are:

show crypto isakmp sa          ! IKEv1 phase 1 SAs
show crypto ikev2 sa           ! IKEv2 SAs
show crypto ipsec sa           ! phase 2 / IPsec SAs and packet counts
show vpn-sessiondb             ! summary of all VPN sessions

For a site-to-site tunnel that will not come up, check show crypto ikev2 sa (or isakmp for IKEv1) first: no phase 1 SA means the problem is peer reachability, pre-shared key, or policy mismatch, not your interesting-traffic ACL.

Management Access and Hardening

Set up management access without leaving the box wide open. Restrict SSH and management to specific source subnets, and never store an enable password with the encrypted keyword unless you are pasting a hash.

! Enable password: the plain command hashes and stores your text.
! Do NOT append 'encrypted' - that keyword expects an already-hashed
! string and will store a broken password if you type a plaintext one.
enable password YourStrongSecret

! Restrict SSH to a management subnet on the inside interface
ssh 10.10.10.0 255.255.255.0 inside
ssh version 2
ssh timeout 10

! Local admin account
username admin password YourStrongSecret privilege 15
aaa authentication ssh console LOCAL

The old advice to run enable password mypassword encrypted is wrong: the encrypted keyword tells the ASA the string that follows is already a hash, so feeding it a plaintext word stores a password nobody can log in with. Use enable password YourStrongSecret and let the ASA hash it.

Monitoring and Troubleshooting

show cpu usage                 ! control-plane CPU
show memory                    ! memory use
show logging                   ! the log buffer (enable 'logging buffered' first)
show interface | include line|errors   ! quick interface error scan

On a healthy ASA that has a switch upstream, note that the ASA itself does not run CDP, so a connected switch will not see it as a CDP neighbor - if you need to confirm the ASA's neighbor, look from the switch side. That behavior, and how to see ASA neighbors properly, is covered in checking CDP neighbors on a Cisco ASA.

Key Takeaways

• Every ASA interface needs a nameif and a security level before it forwards anything; show nameif is your map on an unfamiliar firewall.
• packet-tracer and show xlate are the two commands that make ASA troubleshooting fast - use them before you start reading config.
• Never apply permit tcp any any eq 80 inbound on the outside interface; publish specific services to specific translated addresses.
• Use enable password YourSecret without the encrypted keyword unless you are pasting an existing hash.
• Filter show running-config by section (nat, access-list, interface) instead of dumping the whole config.