ASA · BUDDY SDM

Buddy SDM Manager: build a firewall from the GUI

Select ASA1 and press Open Buddy SDM Manager. Build this firewall from its screens, previewing the commands each form will send before you send them. The console at the bottom of the page is the same session as the main console, so you can type any step instead and watch the screens change. Nothing here depends on which way you choose.

Cisco ASA-style track · Cisco ASA-style, Cisco router · 6 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Interfaces screen: inside on Gi0/0 (level 100, 192.168.1.1/24), outside on Gi0/1 (level 0, 203.0.113.1/24), dmz on Gi0/2 (level 50, 172.16.1.1/24), all up.
Routes screen: a default route on outside to 203.0.113.2.
NAT screen: hide 192.168.1.0/24 behind outside with object INSIDE (PAT), and turn on Inspect ICMP. PC1 reaches 198.51.100.1.
NAT and Access rules screens: publish SRV as 203.0.113.10 with object WEB. Add access list OUTSIDE-IN permitting icmp from any to WEB, with Log on, applied in on outside.
R1 reaches 203.0.113.10. On the Logs screen the Firewall log shows access list OUTSIDE-IN permitting it.
Tools screen: save the configuration. The Command log shows every line you sent.

Start this lab

Before you start

If a blank firewall’s console is waiting at the setup question, sending from a screen answers no for you. A form refuses bad input and sends nothing. If a line fails, the rest are not sent and the page shows the error. The Packet tracer screen tests a TCP or UDP rule, which real pings here cannot: the simulator sends ICMP only.

Concept

A firewall GUI is the CLI with a form in front

A manager screen does not change the firewall by itself. It turns your form into CLI lines, shows them to you, and sends them through the same session as the console. So the screens and the console always agree, and every change is a command you can read, repeat and type yourself. The logs then show both sides: what you told the firewall, and what it did with traffic.

Concept

Firewall security levels and stateful inspection

Each firewall interface has a name and a security level from 0 to 100. Traffic may flow from a higher level to a lower one; the other way needs an access rule. The firewall remembers the connections it allowed, so their replies come back, but an ICMP echo reply only counts as a reply when ICMP is inspected.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.