When an ASA IPsec tunnel will not come up, first identify whether Phase 1 or Phase 2 failed. This article shows the log messages and show output that point to each common cause, with real debugs from a deliberately broken tunnel on a live ASAv 9.23(1).
The full certificate lifecycle for AnyConnect on Cisco ASA 9.x: identity cert generation, CA enrollment, and client certificate authentication, plus the confusing ways each side fails when you get it wrong.
DAP is the ASA's runtime override layer for VPN sessions: match AAA attributes, endpoint posture, and connection data at login, then override what the group policy pushed. Record structure, matching logic, and precedence on a live ASAv.
Wire LDAP, RADIUS, and TACACS+ into the ASA for VPN authentication, authorization, and accounting. Full configuration of all three on a live ASAv 9.23, and when a production firewall uses each one.
Tunnel-groups are the connection profiles users select; group-policies are the attribute bundles the ASA pushes once they connect. This article walks the inheritance chain with real running-config from a live ASAv 9.23(1).
The three split-tunnel modes on Cisco ASA AnyConnect: what each mode tunnels, the configuration for each, and the gotchas that bite in production, with all output from a live ASAv 9.23(1).
AnyConnect over IKEv2/IPsec instead of SSL: real advantages for performance, posture, and FIPS environments. The full remote-access configuration on ASA 9.x, with show output captured from a live ASAv 9.23(1) in the lab.
Full AnyConnect SSL VPN configuration on ASA 9.x: certificate, IP pool, group-policy, tunnel-group, AAA, and the WebVPN service that ties it together. Every show output is from a live ASAv 9.23(1).
Most broken ACL tickets are really misread ACLs. This reference shows how to prove which line a packet actually hit using packet-tracer, show access-list hit counters, and show asp drop, all captured from a live ASAv in the lab.
The ASA evaluates NAT rules in a fixed order and stops at the first match. This cheat sheet lays out the order of operations on software 9.x, grounded in real show nat detail output from the lab.
VPN peers expect to see original inside addresses, and source NAT in the path corrupts the SA selectors. Identity NAT translates a flow to itself. This article shows the configuration with real captures from the PingLabz lab.
Twice NAT translates on source and destination together: PAT to a partner-whitelisted address only when traffic heads to the partner network. Configuration and verification on ASA 9.x with real captures from the reference lab.