ASA Firewall
Course Description
The Cisco ASA (Adaptive Security Appliance) is Cisco’s stateful firewall. In this course you’ll learn how to configure the most important ASA features. We start with firewall basics, security levels, and ASDM, and then configure NAT and PAT, access-lists, VLANs and sub-interfaces, site-to-site and remote access IPsec VPNs, Cisco Secure Client (formerly AnyConnect) SSL VPN, syslog, and active/standby failover. We finish with the tools you need to find out why the ASA drops a packet.
Course Highlights
In this course you will learn:
- How a stateful firewall works, and how the ASA uses security levels to permit traffic between interfaces.
- How to manage the ASA from the CLI and with ASDM.
- How to configure dynamic NAT, PAT, static NAT, port forwarding, and NAT exemption.
- How to permit traffic with access-lists, object groups, and time-based access-lists.
- How to create extra security zones with VLANs and sub-interfaces.
- How to configure site-to-site IPsec VPNs with IKEv1 and IKEv2, pre-shared keys, and digital certificates.
- How to configure remote access VPN with IPsec and Cisco Secure Client (formerly AnyConnect) SSL VPN.
- How to configure syslog and active/standby failover.
- How to troubleshoot packet drops with packet-tracer, packet captures, and ASP drops.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 33 lessons in 8 units.
- Who it’s for: network engineers who configure and manage Cisco ASA firewalls.
- Format: self-paced lessons with Cisco ASA configurations, packet captures, and video.
- Last updated: October 2026.
Requirements
- No ASA knowledge required; we start with the basics of firewalls.
- Knowledge of IP addressing, routing, and access-lists will make this course a lot easier to understand.
Course Schedule
What is a Cisco ASA firewall?
The Cisco ASA (Adaptive Security Appliance) is a hardware or virtual (ASAv) firewall. It sits between a trusted network, like your LAN, and an untrusted network, like the Internet, and checks every packet that passes through it. The ASA is a stateful firewall: it keeps track of all connections, so when a host on the inside opens a connection, the return traffic is permitted automatically.
A router with an access-list checks each packet on its own and doesn’t remember what it has seen before. The ASA works with security zones instead. Each interface has a security level from 0 to 100: traffic from a higher to a lower security level is permitted, and traffic from a lower to a higher security level is denied unless an access-list permits it. Besides filtering, the ASA does NAT and PAT, terminates site-to-site and remote access VPNs, and supports stateful failover between two firewalls.
Who uses the ASA? You’ll find it at the Internet edge of many company networks, where it protects the LAN, publishes servers in a DMZ, and connects branch offices and remote users with IPsec and SSL VPNs. If you manage a network with an ASA, or you want to understand how firewalls work in practice, this course is for you.
Cisco ASA Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Cisco ASA Basics
We start with what a firewall is: stateful filtering, packet inspection, and security zones. On the ASA, each interface gets a security level; the inside is usually 100, the outside 0, and a DMZ somewhere in between. You also learn how to reset the ASA to its factory default configuration and how to enable ASDM, the GUI to configure and monitor the ASA.
Cisco ASA NAT and PAT
Since ASA 8.3, NAT is configured with network objects. Dynamic NAT and PAT let inside hosts reach the outside with a pool of addresses or a single address; you’ll also configure dynamic NAT for a DMZ and learn the difference between per-session and multi-session PAT. Static NAT and port forwarding make servers on the inside or DMZ reachable from the Internet, and NAT exemption keeps traffic that goes through a VPN tunnel from being translated. When internal hosts want to reach a server through its outside address, you need hairpinning.
Access-Lists and Security Zones
Without access-lists, the ASA only permits traffic from a higher to a lower security level. Access-lists let you make exceptions, for example to permit traffic from the Internet to a web server in the DMZ. Object groups keep large access-lists readable, time-based access-lists only apply during the hours you configure, and you’ll also learn how to remove an access-list. When you need more security zones than you have physical interfaces, you can use VLANs and sub-interfaces.
Site-to-Site IPsec VPN
A site-to-site IPsec VPN connects two LANs over the Internet. We configure IKEv1 and IKEv2 tunnels between two ASAs, and then look at peers with a dynamic IP address, multiple dynamic peers with their own tunnel-groups, and digital certificates instead of pre-shared keys. You’ll also build an IKEv2 tunnel between an ASA and a Linux strongSwan server.
Remote Access VPN
Remote access VPN lets users connect to your network from anywhere. We start with remote access IPsec VPN, then configure Cisco Secure Client (formerly AnyConnect), which supports SSL and IKEv2 IPsec and gives the user full network access. To get rid of certificate warnings, you can use a self-signed certificate, and with the ASA as local CA you can add user certificates for two-factor authentication. VPN filters restrict what remote users can reach, and hairpinning lets users without split tunneling reach the Internet through the ASA.
Management, Failover and Troubleshooting
Before you configure logging, set the clock so your syslog messages have correct timestamps. Since the ASA is often a critical device, a second ASA in active/standby failover takes over when the active one fails; the failover is stateful, so connections and NAT translations survive. When the ASA drops traffic you want to permit, packet drop troubleshooting tools like connection state, syslog, ASP drops, packet captures, and packet-tracer tell you why.
Frequently Asked Questions
The older ASA 5500-X hardware models have reached end of life, but the ASA software hasn’t. You can still run ASA software on Cisco’s newer Secure Firewall hardware and as a virtual ASAv, and Cisco still releases new ASA versions. Many networks still run ASAs, so the CLI, NAT, and VPN skills you learn here remain useful.
Yes, if you work on networks that use Cisco firewalls. Plenty of companies still run ASAs, and the concepts you learn, like stateful filtering, NAT, site-to-site and remote access VPNs, and failover, apply to every firewall vendor. It’s also a good foundation before you move on to Secure Firewall Threat Defense (FTD). Start with an introduction to firewalls.
Secure Firewall Threat Defense (FTD, formerly Firepower Threat Defense) is Cisco’s next-generation firewall software. It adds features like intrusion prevention, application control, and URL filtering on top of a stateful firewall. Under the hood, FTD still uses ASA code for its firewall functions, so much of what you learn about the ASA also helps you understand FTD. Cisco’s current Secure Firewall hardware can run either ASA or FTD software.
The Cisco ASA (Adaptive Security Appliance) is a stateful firewall. It protects your network by checking all traffic between security zones like the inside, outside, and DMZ. It also does NAT and PAT, site-to-site and remote access VPN, and failover. Learn the basics of firewalls.
A stateless filter, like an access-list on a router, checks each packet on its own. A stateful firewall keeps track of all connections, so when a host on the inside starts a connection, the firewall automatically permits the return traffic. The Cisco ASA is a stateful firewall. Read our introduction to firewalls.
Each ASA interface has a security level between 0 and 100 that shows how trusted it is. Traffic from a higher to a lower security level is permitted by default, and traffic from a lower to a higher security level is denied unless an access-list permits it. The inside interface usually has security level 100 and the outside 0. Learn about ASA security levels.
Use the ASAv, the virtual version of the ASA. You can run it in an emulator like CML or EVE-NG and practice almost everything in this course, including NAT, access-lists, VPNs, and failover. Used ASA 5500-X appliances are cheap too, but they’re end of life, so a virtual lab is usually the better choice.