The classic three-zone ASA build end to end on an ASAv 9.23: inside, outside, and DMZ security levels, outbound NAT, inbound web publishing, ACLs in both directions, and the show output that proves traffic flows.
The day-0 commands that take a fresh ASA from factory empty to ready: hostname, enable secret, interfaces, default route, SSH management, NTP, basic syslog, and a write to startup. Skip the setup wizard and configure it directly.
Object groups collapse a 36-line ASA ACL to one line and turn subnets, hosts, and pools into named objects you reference everywhere. Covers the four object-group types, nesting, and real show output from the lab's running OUTSIDE_IN ACL.
ASA interfaces differ from IOS in two ways that matter: every data interface needs nameif and security-level, and there is no DTP, so 802.1Q trunks are built purely from subinterfaces. Covers physical interfaces, subinterfaces, and trunks to a Catalyst.
Routed mode makes the ASA a Layer 3 hop; transparent mode makes it a Layer 2 bridge you can drop into an existing subnet without re-IP'ing anything. This article covers both modes, the config, and what breaks when you flip.
A field guide to the four most common ASA outage patterns: NAT pool exhaustion, ACL shadowing, a VPN up with no traffic, and failover split brain, each with the one show command that decides it.
show conn and show xlate answer almost every question about whether traffic is flowing through the ASA. This article walks both tables, the most useful filters, and the clear commands, with live output from ASAv 9.23(1).
Most ASP drops leave no syslog and no ACL hit, just a counter in show asp drop. This article decodes the common drop reasons and chains the counter with an asp-drop type capture to see the discarded packets, on a live ASAv 9.23.
The four ASA CLI capture modes you will use most: interface raw-data, ASP-drop, type asp-all, and match-filter, all with real output from a live ASAv 9.23(1). Capture proves whether the packet arrived and where the data plane dropped it.
Stateful failover replicates the ASA's connection table, xlate table, and ARP to the standby so in-flight sessions survive a unit failure. This post walks the configuration, the healthy sync output, and interface tracking.
Two identical ASAs, a dedicated failover link, and sub-second promotion when the active unit dies. Walk the full active/standby configuration, the show commands you read to verify it, and the gotchas that bite on real builds.
AnyConnect login failures come down to AAA or certificates. This guide maps each symptom to the exact show and debug command that confirms the cause, with output from a live ASAv 9.23(1) in the lab.