Cisco ASA Firewall Training

This is the beginning of the course. Here I will take you to some of the commands which will help you getting the information about Cisco ASA.

You will learn Nameif, Security-level, default restriction of traffic from High to low security levels and vice versa.

Cisco ASA does not allow ICMP to pass through by default. You will learn on how to allow ICMP to work in ASA. You will also get to know how to configure static routes in firewall. It is bit different but not difficult.

It has information on some of the things I did not cover in Initial videos. You will also learn a very good command which will tell you whether ASA will permit or deny the traffic without having to generate the traffic.

It is not always easy to get the console access of Cisco ASA. Best way is that we access it remotely, one of the ways is Telnet and Other is SSH.

In this lecture, I will show you how to enable telnet on ASA for hosts or subnets.

Remember that Telnet is not a preferred and secured way to access a Security Appliance. SSH Is better.

In this, learn Telnet and in next video, you will have SSH information available.

SSH stands for Secured Shell, It works on TCP port 22 and regarded as one of the most secured method to remotely access ASA or any device because it uses RSA crypto key.

In this video, you will learn the steps to enable SSH for your Hosts or Subnets. 10 minutes Watch.

There are two types of ACLs, one is Interface level and other one is Global. You will see the difference, configuration and order of processing.

It has lot of information covered of Access Control List.

In Real world, you will get access to firewall which will have lot of rules, may be in 1000s or may be more. So , it will not be easy for you to manage those rules when time comes to configure or update the existing access-lists.

You will find this Object-Group concept much easier and interesting once you work with ACLs in ASA.

Even though, you found object-group to be real helper in managing the ACLs, you will notice that you still need an easy way to edit the ACLs statements such as changing the IP address of Host on all of the access-groups whereever it's referenced.

Creating Object will make it very easy for you to update the new Host or subnet or Port information all over the ASA.

You must have got in  to scenarios where devices went faulty, then you realize the importance of having backup device. We need to make sure that the backup switch automatically takes care of network connectivity should there be outage/failure in primary device.

Failover is the same thing, we need to configure our Firewall in such a fashion that the standby switch takes control automatically.

Here, you will learn the steps to configure the Failover in Cisco ASA. It is very easy.

There are two modes in ASA, one is Router and other one is Transparent. Router mode works like router i.e number of interfaces of ASA will have different segments and ability to run routing protocols. ASA Transparent works like a bump in the wire i.e. it will sit between two devices which are in same segment and silently listens to packets and do it's job.

You will learn more about this in the lecture and see how it is configured.

In the previous video, you learnt about creating single bridge group in two ways , first with physical interfaces and second with using sub-interfaces.

Now, you will see how to configure multiple bridge groups in ASA. You will also see whether more than one interface can be added in one Bridge group or not.

Testing will be done.

We all know that ASA is a security appliance which primarily performs the functions of Filtering, Stateful Inspection, VPN and NAT. However, we must be aware that we can run IP routing functions ( Static and Dynamic Routing) on Cisco ASA Firewall and it is very simple. I have shown steps to do the same. Though there are some restrictions, but that does not deny us the ability to configure most of the important functions of Routing Protocols.

You must have heard the name "Link Level Failover" where one link goes down and alternate one takes over. It is very similar to that. Here, we will logically combine physical interfaces of ASA firewall and name it as "Redundant Interface". All of the configuration is done on Redundant Interface.  Only one of the member interfaces remains Active at one time.

See this video to understand how this works and configured on Cisco ASA Firewall.

It is very important topic to discuss as it is bit complex. Whenever we access Internet from our trusted network, we need Public IP as Source IP. If we do not have Public IP then we need to use Private IPs and NAT alongside it.

Watch this lecture to understand the theory behind it.

It is the simplest of all types of NAT because it means one to one mapping and that too bi-directional. It means you do not need separate NAT statement to make reverse traffic pass thru firewall.

I will use ObjectNAT here i.e. NAT statement for static will be created within the Object. You will see how traffic works in both direction with just a simple static nat statement.

Static NAT is one to one translation or mapping. In the latest OS of ASA, it can be configured in two ways - one way is Auto NAT i.e. inside the object. Second way is manual NAT i.e. in the global configuration mode.

Manual NAT is also known as Policy NAT. In this you will see how NAT decision is made on the basis of both Source and Destination traffic.

You will also see the comparison of Auto and Manual NAT to understand which one takes precedence.

Twice NAT is also part of Manual NAT. This will be discussed later on

Both Static NAT and PAT are one to one mapping. Challenge with Static NAT is that one NAT'ed IP can't be used at multiple Static NAT statements, therefore we need to use PAT. In PAT, we will use port numbers to make static translations unique. Static PAT is mostly used when your internal servers are being accessed from outside, then you can use single NAT'ed IP address in conjunction with port numbers. It also provides you security if you are using port -redirection.

Watch this video get more information.

Here is another way of configuring the Static PAT statement using Manual NAT. Only difference between Auto NAT and Manual NAT is the syntax of the the command.

Also, you will understand what is Identity NAT.

In this video, you will learn to configure many to many mapping in NAT, as known as "Dynamic NAT". We will create a pool of IP addresses for NATing and then this pool will be mapped to a subnet.

You will also know what happens when pool is not left with any IP for NAT allocation. Overall, it will be fun to work on Dynamic NAT.

Here you will see how to configure your ASA with Dynamic NAT using Manual NAT or Policy NAT. I will use two different Dynamic Pools here to make this video little complex. In the policy NAT, you can mention both source and destination and then make NAT decision.

In this lecture, you will learn MANY to ONE mapping for NAT. Instead of a pool of IP Addresses, we will use a single IP Address for mapping OR the IP address of Gateway.

ASA will map the Internal Subnets IP addresses to this Single PAT IP using available port numbers. Source IP with random port number will be mapped to PAT IP with random port number to maintain unique connection.

It is very interesting topic.

When you have only one Public IP address for doing NAT for many Internal IP addresses dynamically, then you use Dynamic PAT. There are two ways to do it, one is Auto NAT and second one is Manual NAT aka Policy NAT.

This video will guide you to do Dynamic PAT configuration using Manual NAT. It is super easy.

In some rare scenario, you will get task to NAT the IP which is part of Internet or outside of your network. Watch this lecture to know what happens when destination NAT is not configured and how to setup the Destination NAT. You will also find it very easy to NAT the destination IP address. In 98% of the cases in real life, we use source NAT.