ASA-specific firewall configuration (different syntax from IOS routers).
Basic Interface & Security Levels
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 203.0.113.1 255.255.255.0
no shutdown
Mode: interface config
Configure interface with name and security level (0=outside, 100=inside).
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
Mode: interface config
Inside interface (high security). Traffic from high→low allowed by default.
Network Objects & NAT
object network WEB-SERVER
host 192.168.1.10
nat (inside,outside) static 203.0.113.10
Mode: global config
Static 1:1 NAT for a single host (object-based NAT).
object network INSIDE-NET
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic interface
Mode: global config
Dynamic PAT (NAT overload) for entire subnet using interface IP.
object network PAT-POOL
range 203.0.113.10 203.0.113.20
!
object network INSIDE-NET
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic PAT-POOL
Mode: global config
Dynamic PAT using a pool of public IPs.
Access Control Lists (ACLs)
access-list OUTSIDE-IN extended permit tcp any host 203.0.113.10 eq 443
access-list OUTSIDE-IN extended deny ip any any log
!
access-group OUTSIDE-IN in interface outside
Mode: global config
Extended ACL allowing HTTPS to web server, deny all else.
object-group service WEB-SERVICES tcp
port-object eq 80
port-object eq 443
!
access-list OUTSIDE-IN extended permit tcp any object WEB-SERVER object-group WEB-SERVICES
Mode: global config
Use object-groups for cleaner ACLs with multiple services.
show access-list
show access-list OUTSIDE-IN
show run access-list
Mode: privileged EXEC
Verify ACL configuration and hit counts.
Site-to-Site VPN (IKEv2)
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 14
prf sha256
lifetime seconds 86400
!
crypto ikev2 enable outside
Mode: global config
IKEv2 Phase 1 policy with strong encryption.
crypto ipsec ikev2 ipsec-proposal STRONG
protocol esp encryption aes-256
protocol esp integrity sha-256
!
crypto map VPN-MAP 10 match address VPN-TRAFFIC
crypto map VPN-MAP 10 set peer 203.0.113.50
crypto map VPN-MAP 10 set ikev2 ipsec-proposal STRONG
crypto map VPN-MAP interface outside
Mode: global config
IPsec Phase 2 proposal and crypto map.
tunnel-group 203.0.113.50 type ipsec-l2l
tunnel-group 203.0.113.50 ipsec-attributes
ikev2 remote-authentication pre-shared-key Str0ngKey!
ikev2 local-authentication pre-shared-key Str0ngKey!
Mode: global config
Tunnel group for site-to-site VPN with pre-shared key.
access-list VPN-TRAFFIC extended permit ip 192.168.1.0 255.255.255.0 10.10.10.0 255.255.255.0
Mode: global config
Interesting traffic for VPN encryption.
AnyConnect Remote Access VPN
ip local pool VPN-POOL 10.10.10.1-10.10.10.254 mask 255.255.255.0
!
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.10.xxxxx-webdeploy-k9.pkg
anyconnect enable
Mode: global config
Enable AnyConnect with IP pool for remote users.
group-policy RemoteUsers internal
group-policy RemoteUsers attributes
vpn-tunnel-protocol ssl-client ikev2
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL-ACL
!
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool VPN-POOL
default-group-policy RemoteUsers
Mode: global config
Group policy with split tunneling for AnyConnect.
username vpnuser password Str0ngP@ss! encrypted
username vpnuser attributes
vpn-group-policy RemoteUsers
service-type remote-access
Mode: global config
Local user account for VPN authentication.
Verification & Troubleshooting
show interface ip brief
show nameif
show route
show xlate
show conn
Mode: privileged EXEC
Basic ASA status: interfaces, NAT translations, connections.
show crypto ikev2 sa
show crypto ipsec sa
show vpn-sessiondb anyconnect
show vpn-sessiondb detail anyconnect
Mode: privileged EXEC
VPN session monitoring and troubleshooting.
packet-tracer input outside tcp 1.2.3.4 12345 203.0.113.10 443 detailed
Mode: privileged EXEC
Simulate packet flow through ASA (firewall policy, NAT, routing).