ASA · FIRST CONFIGURATION

ASA-style: interfaces, security levels and a way out

A new firewall passes nothing. Each interface needs a name and a security level: traffic flows freely from a higher level to a lower one, and needs a rule the other way. PC1 is inside, SRV on a DMZ, and R1 is the provider, with 198.51.100.0/24 behind it and no route back to your private addresses, so the inside must be translated.

Cisco ASA-style track · Cisco ASA-style, Cisco router · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Name the interfaces: Gi0/0 inside (level 100, 192.168.1.1/24), Gi0/1 outside (level 0, 203.0.113.1/24) and Gi0/2 dmz (level 50, 172.16.1.1/24), and bring them up.
Add a default route to the provider, 203.0.113.2.
Translate the inside to the outside interface address: object network INSIDE with nat (inside,outside) dynamic interface.
Ping 198.51.100.1 from PC1 and read the reason: the echo reply comes back from level 0. Add inspect icmp to the global policy.
PC1 reaches 198.51.100.1, and SRV (172.16.1.10), but SRV cannot start a ping to PC1.

Start this lab