Objectives
The simulator ticks each one as soon as the network meets it.
The server is published on the wrong address: object WEB must map to 203.0.113.10.
The access list for the outside was applied in the wrong direction: apply OUTSIDE-IN in, not out.
ICMP is no longer inspected: add inspect icmp back to the global policy.
R1 reaches 203.0.113.10, and PC1 reaches 198.51.100.1.
Before you start
Fix one fault at a time and ping again: each fault gives its own reason. An access-group out checks traffic leaving the interface, which is not where the provider’s traffic arrives.
Concept
Firewall security levels and stateful inspection
Each firewall interface has a name and a security level from 0 to 100. Traffic may flow from a higher level to a lower one; the other way needs an access rule. The firewall remembers the connections it allowed, so their replies come back, but an ICMP echo reply only counts as a reply when ICMP is inspected.
Concept
Firewall NAT: three sections, applied in order
An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.
