Cisco Adaptive Security Appliance, the stateful firewall platform that has anchored enterprise perimeters for two decades and is now being succeeded by Secure Firewall (FTD). Articles tagged ASA cover security levels, NAT 8.3+ and twice NAT, ACLs, AnyConnect SSL and IKEv2 VPN, site-to-site IPsec, failover, packet-tracer, hardening, and ASAv 9.x lab walkthroughs.
ASA NAT stops being a guessing game once you can read the NAT table: three sections, top to bottom, first match wins. This guide shows you the table in one command and how to predict which rule translates a packet.
Identity NAT is the ASA rule whose whole job is to not translate. You build a static identity NAT between an inside network and a DMZ on a live ASAv, then prove it changes nothing with show nat detail and packet-tracer.
Publish a private server through a Cisco ASA with destination NAT: the static object NAT config that maps a public address inbound, plus the exact order the ASA processes the packet on the way in.
Configure SSH, HTTPS, SNMPv3, NTP, and syslog on the Cisco ASA the secure way. Every capture is real, taken over SSH from a Linux host to an ASAv 9.24(1) running in Cisco Modeling Labs.
RIPv2 still shows up at interop boundaries, so here is how it behaves on a Cisco ASA. Two real captures from an ASAv 9.24 peering with IOS XE show it authenticating loudly and almost never winning a route.
Full EIGRP build on the Cisco ASA captured live from an ASAv 9.24, from working adjacency to the number-one neighbor failure that produces no error, no log, just an empty neighbor table.
The full OSPF build on a Cisco ASA: configuration, a verified adjacency with MD5 authentication, the DR/BDR election the firewall loses, the link-state database, and redistribution, all captured from a live ASAv 9.24.
The ASA supports OSPF, EIGRP, RIP, and BGP, but with different defaults and its own opinions about which routes it installs. Get oriented with live captures from an ASAv 9.24 in CML before you configure any of them.
When to migrate from ASA to Secure Firewall Threat Defense, what tooling does the migration well, what it does not move automatically, and what to verify on the FTD side before declaring the migration done.
Multiple context mode turns one Cisco ASA into several virtual firewalls, each with its own config, interfaces, ACLs, NAT, and admins. Covers the system, admin, and user-context split, what the feature costs, and the configuration to enable it.
The ASA Modular Policy Framework binds inspection engines to traffic with class-maps, policy-maps, and service-policies. Walk the default global policy every ASA ships with, then add custom HTTP, FTP, or ESMTP inspection without breaking it.
The production-ready ASA upgrade procedure: back up off-box, stage the image to flash, set the boot variable, reload, verify, and roll back if needed. Works for a single ASA or a failover pair.