ASA Firewall

Course at a glance

• 33 lessons in 8 units.
• Who it’s for: network engineers who configure and manage Cisco ASA firewalls. The introduction to firewalls also covers the firewall topics of CCNA 200-301 and CCNP ENCOR 350-401.
• Format: self-paced lessons with Cisco ASA configurations, packet captures, and video.
• Last updated: October 2026.

What is a Cisco ASA firewall?

The Cisco ASA (Adaptive Security Appliance) is a hardware or virtual (ASAv) firewall. It sits between a trusted network, like your LAN, and an untrusted network, like the Internet, and checks every packet that passes through it. The ASA is a stateful firewall: it keeps track of all connections, so when a host on the inside opens a connection, the return traffic is permitted automatically.

A router with an access-list checks each packet on its own and doesn’t remember what it has seen before. The ASA works with security zones instead. Each interface has a security level from 0 to 100: traffic from a higher to a lower security level is permitted, and traffic from a lower to a higher security level is denied unless an access-list permits it. Besides filtering, the ASA does NAT and PAT, terminates site-to-site and remote access VPNs, and supports stateful failover between two firewalls.

Who uses the ASA? You’ll find it at the Internet edge of many company networks, where it protects the LAN, publishes servers in a DMZ, and connects branch offices and remote users with IPsec and SSL VPNs. If you manage a network with an ASA, or you want to understand how firewalls work in practice, this course is for you.

Cisco ASA Learning Roadmap

This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.

Cisco ASA Basics

We start with what a firewall is: stateful filtering, packet inspection, and security zones. On the ASA, each interface gets a security level; the inside is usually 100, the outside 0, and a DMZ somewhere in between. You also learn how to reset the ASA to its factory default configuration and how to enable ASDM, the GUI to configure and monitor the ASA.

Lessons: Introduction to firewalls, Security levels, ASDM configuration, Erase configuration

Cisco ASA NAT and PAT

Since ASA 8.3, NAT is configured with network objects. Dynamic NAT and PAT let inside hosts reach the outside with a pool of addresses or a single address. Static NAT and port forwarding make servers on the inside or DMZ reachable from the Internet, and NAT exemption keeps traffic that goes through a VPN tunnel from being translated. When internal hosts want to reach a server through its outside address, you need hairpinning.

Lessons: Dynamic NAT, Dynamic NAT with DMZ, PAT, Static NAT, Port forwarding, NAT exemption, Per-session vs multi-session PAT, Hairpin internal server

Access-Lists and Security Zones

Without access-lists, the ASA only permits traffic from a higher to a lower security level. Access-lists let you make exceptions, for example to permit traffic from the Internet to a web server in the DMZ. Object groups keep large access-lists readable, and time-based access-lists only apply during the hours you configure. When you need more security zones than you have physical interfaces, you can use VLANs and sub-interfaces.

Lessons: ASA access-lists, Object groups, Time-based access-lists, Remove an access-list, VLANs and sub-interfaces

Site-to-Site IPsec VPN

A site-to-site IPsec VPN connects two LANs over the Internet. We configure IKEv1 and IKEv2 tunnels between two ASAs, and then look at peers with a dynamic IP address, multiple dynamic peers with their own tunnel-groups, and digital certificates instead of pre-shared keys. You’ll also build an IKEv2 tunnel between an ASA and a Linux strongSwan server.

Lessons: Site-to-site IKEv1 IPsec VPN, Site-to-site IKEv2 IPsec VPN, Dynamic peer, Multiple dynamic peers, Digital certificates, IKEv2 between ASA and strongSwan

Remote Access VPN

Remote access VPN lets users connect to your network from anywhere. We start with remote access IPsec VPN, then configure AnyConnect, which supports SSL and IKEv2 IPsec and gives the user full network access. To get rid of certificate warnings, you can use a self-signed certificate, and with the ASA as local CA you can add user certificates for two-factor authentication. VPN filters restrict what remote users can reach, and hairpinning lets users without split tunneling reach the Internet through the ASA.

Lessons: Remote access IPsec VPN, AnyConnect remote access VPN, Self-signed certificate, AnyConnect local CA, VPN filter, Hairpin remote VPN users

Management, Failover and Troubleshooting

Before you configure logging, set the clock so your syslog messages have correct timestamps. Since the ASA is often a critical device, a second ASA in active/standby failover takes over when the active one fails; the failover is stateful, so connections and NAT translations survive. When the ASA drops traffic you want to permit, tools like connection state, syslog, ASP drops, packet captures, and packet-tracer tell you why.

Lessons: Clock configuration, Syslog configuration, Active/standby failover, Packet drop troubleshooting

Ready to master the Cisco ASA?

Get access to all 33 Cisco ASA lessons and every other course on NetworkLessons.com.

Sign up