Cisco Adaptive Security Appliance, the stateful firewall platform that has anchored enterprise perimeters for two decades and is now being succeeded by Secure Firewall (FTD). Articles tagged ASA cover security levels, NAT 8.3+ and twice NAT, ACLs, AnyConnect SSL and IKEv2 VPN, site-to-site IPsec, failover, packet-tracer, hardening, and ASAv 9.x lab walkthroughs.
With the ASA clock on UTC-8, its legacy syslog timestamp carried no timezone, so a collector that assumed UTC put an ASA deny almost eight hours before the IOS XE permit for the same ping. UTC plus logging timestamp rfc5424 fixed the order.
Two inside hosts using the same source port left an ASAv PAT as 198.18.60.1:7113 and :40000. Only show xlate tied each outside Zeek flow to its inside host. An ASA clock fault then broke a 5-second time-window join while traffic kept working.
One static route sent client SYNs around the ASA while SYN-ACKs crossed it, so the ASA dropped them as tcp-not-syn with syslog 106015. Restoring routing fixed it; a scoped TCP state bypass also worked once the outside ACL allowed the return.
Both ASAv data interfaces were up, the ACL permitted the traffic and PAT was configured, yet the first pings failed. ASP drop counters showed no-route to a target beyond the outside subnet. One default route fixed ping and HTTP.
The static NAT rule and the outside ACL were unchanged, yet the published website timed out. A stale section 1 manual rule mapped the same address to an old backend, and syslog 106023 named it. Removing the rule fixed HTTP.
Cisco removed Clientless SSL VPN (WebVPN) from the ASA in 9.17. Real 9.24 CLI proof, and the Secure Client remote-access VPN that replaced it.
Enable ASDM on a Cisco ASA 9.24, hit the image-not-set gotcha, and get the honest 2026 verdict on the Java GUI versus the CLI.
Endpoint versus pass-through on the Cisco ASA: inspect ipsec-pass-thru, NAT-T on UDP 4500, and the classic Phase 1 up, Phase 2 down failure.
Map IKEv1 to IKEv2 on the Cisco ASA command by command, then cut a live site-to-site tunnel over without an outage.
A real LAN-to-LAN IKEv2 tunnel from a Cisco ASA to an IOS XE peer, verified with show vpn-sessiondb from a live CML capture.
EtherType ACLs let a transparent-mode Cisco ASA filter non-IP frames a routed firewall never sees. Learn what bridges through a Layer 2 firewall by default and how to control it.
Typing firewall transparent wipes the ASA's entire running configuration instantly. This walkthrough covers switching modes safely from the console with a saved config, then building a working transparent-mode firewall on the ASAv.