Cisco Adaptive Security Appliance, the stateful firewall platform that has anchored enterprise perimeters for two decades and is now being succeeded by Secure Firewall (FTD). Articles tagged ASA cover security levels, NAT 8.3+ and twice NAT, ACLs, AnyConnect SSL and IKEv2 VPN, site-to-site IPsec, failover, packet-tracer, hardening, and ASAv 9.x lab walkthroughs.
Stateful failover replicates the ASA's connection table, xlate table, and ARP to the standby so in-flight sessions survive a unit failure. This post walks the configuration, the healthy sync output, and interface tracking.
Two identical ASAs, a dedicated failover link, and sub-second promotion when the active unit dies. Walk the full active/standby configuration, the show commands you read to verify it, and the gotchas that bite on real builds.
AnyConnect login failures come down to AAA or certificates. This guide maps each symptom to the exact show and debug command that confirms the cause, with output from a live ASAv 9.23(1) in the lab.
When an ASA IPsec tunnel will not come up, first identify whether Phase 1 or Phase 2 failed. This article shows the log messages and show output that point to each common cause, with real debugs from a deliberately broken tunnel on a live ASAv 9.23(1).
The full certificate lifecycle for AnyConnect on Cisco ASA 9.x: identity cert generation, CA enrollment, and client certificate authentication, plus the confusing ways each side fails when you get it wrong.
DAP is the ASA's runtime override layer for VPN sessions: match AAA attributes, endpoint posture, and connection data at login, then override what the group policy pushed. Record structure, matching logic, and precedence on a live ASAv.
Wire LDAP, RADIUS, and TACACS+ into the ASA for VPN authentication, authorization, and accounting. Full configuration of all three on a live ASAv 9.23, and when a production firewall uses each one.
Tunnel-groups are the connection profiles users select; group-policies are the attribute bundles the ASA pushes once they connect. This article walks the inheritance chain with real running-config from a live ASAv 9.23(1).
The three split-tunnel modes on Cisco ASA AnyConnect: what each mode tunnels, the configuration for each, and the gotchas that bite in production, with all output from a live ASAv 9.23(1).
AnyConnect over IKEv2/IPsec instead of SSL: real advantages for performance, posture, and FIPS environments. The full remote-access configuration on ASA 9.x, with show output captured from a live ASAv 9.23(1) in the lab.
Full AnyConnect SSL VPN configuration on ASA 9.x: certificate, IP pool, group-policy, tunnel-group, AAA, and the WebVPN service that ties it together. Every show output is from a live ASAv 9.23(1).
Most broken ACL tickets are really misread ACLs. This reference shows how to prove which line a packet actually hit using packet-tracer, show access-list hit counters, and show asp drop, all captured from a live ASAv in the lab.