Cisco Adaptive Security Appliance, the stateful firewall platform that has anchored enterprise perimeters for two decades and is now being succeeded by Secure Firewall (FTD). Articles tagged ASA cover security levels, NAT 8.3+ and twice NAT, ACLs, AnyConnect SSL and IKEv2 VPN, site-to-site IPsec, failover, packet-tracer, hardening, and ASAv 9.x lab walkthroughs.
Six lines of config give the ASA sane production syslog. This article walks the destinations, the eight severity levels, message lists for filtering, and reading the %ASA-X-XXXXXX format using real lab logs from IKEv2 failures and ACL denies.
A production-ready hardening pass for the Cisco ASA management plane: SSH and HTTPS the right way, AAA with local fallback, per-interface management ACLs, password policy, and disabling what you do not need.
Static routes, default routes, administrative distance, and SLA-tracked failover for multi-WAN on the Cisco ASA, plus how to read show route. Most production firewalls run all-static routing, and this is the syntax that runs them.
The classic three-zone ASA build end to end on an ASAv 9.23: inside, outside, and DMZ security levels, outbound NAT, inbound web publishing, ACLs in both directions, and the show output that proves traffic flows.
The day-0 commands that take a fresh ASA from factory empty to ready: hostname, enable secret, interfaces, default route, SSH management, NTP, basic syslog, and a write to startup. Skip the setup wizard and configure it directly.
Object groups collapse a 36-line ASA ACL to one line and turn subnets, hosts, and pools into named objects you reference everywhere. Covers the four object-group types, nesting, and real show output from the lab's running OUTSIDE_IN ACL.
ASA interfaces differ from IOS in two ways that matter: every data interface needs nameif and security-level, and there is no DTP, so 802.1Q trunks are built purely from subinterfaces. Covers physical interfaces, subinterfaces, and trunks to a Catalyst.
Routed mode makes the ASA a Layer 3 hop; transparent mode makes it a Layer 2 bridge you can drop into an existing subnet without re-IP'ing anything. This article covers both modes, the config, and what breaks when you flip.
A field guide to the four most common ASA outage patterns: NAT pool exhaustion, ACL shadowing, a VPN up with no traffic, and failover split brain, each with the one show command that decides it.
show conn and show xlate answer almost every question about whether traffic is flowing through the ASA. This article walks both tables, the most useful filters, and the clear commands, with live output from ASAv 9.23(1).
Most ASP drops leave no syslog and no ACL hit, just a counter in show asp drop. This article decodes the common drop reasons and chains the counter with an asp-drop type capture to see the discarded packets, on a live ASAv 9.23.
The four ASA CLI capture modes you will use most: interface raw-data, ASP-drop, type asp-all, and match-filter, all with real output from a live ASAv 9.23(1). Capture proves whether the packet arrived and where the data plane dropped it.