Cisco ASA Firewall Basic Configuration in Packet Tracer

Nerd Cafe | نرد کافه

Understanding the Network Topology

• In the ASA world, we divide the network into Zones. Each zone is assigned a Security Level from 0 to 100.

• Inside (Level 100): Your trusted internal network (employees/PCs).

• DMZ (Level 70): The "Demilitarized Zone." This is a partially trusted area where you keep servers (Web, Email) that outsiders need to access.

• Outside (Level 0): The untrusted public internet.

The Golden Rule: By default, traffic can flow from a Higher level to a Lower level (e.g., Inside to Outside), but traffic from a Lower level to a Higher level is blocked unless you write a specific rule to allow it.

IP Address Table

Interface	Zone Name (nameif)	Security Level	IP Address	Description
Et 0/0	inside	100	192.168.100.1	Trusted LAN
Et 0/2	DMZ	70	172.16.10.1	Server Farm
Et 0/1	outside	0	20.20.20.1	Internet Gateway

Step-by-Step Configuration with Explanations

Step 1: Basic Identity & Security

First, we name the device and set passwords to prevent unauthorized changes.

ciscoasa>enable
Password: 
ciscoasa#configure terminal 
ciscoasa(config)#hostname NERDCAFE-FW
ciscoasa(config)#hostname NERDCAFE-FW
NERDCAFE-FW(config)#enable password pass123
NERDCAFE-FW(config)#username admin password pass2

Step 2: Configuring Interfaces

On an ASA, an interface isn't active until it has a Name and a Security Level.

NERDCAFE-FW(config)#interface gigabitEthernet 1/1
NERDCAFE-FW(config-if)#no shutdown 
NERDCAFE-FW(config-if)#ip address 192.168.100.1 255.255.255.0
NERDCAFE-FW(config-if)#nameif INSIDE
INFO: Security level for "INSIDE" set to 0 by default.
NERDCAFE-FW(config-if)#security-level 100
NERDCAFE-FW(config-if)#exit
NERDCAFE-FW(config)#interface gigabitEthernet 1/2
NERDCAFE-FW(config-if)#no shutdown 
NERDCAFE-FW(config-if)#ip address 20.20.20.1 255.255.255.0
NERDCAFE-FW(config-if)#nameif OUTSIDE
INFO: Security level for "OUTSIDE" set to 0 by default.
NERDCAFE-FW(config-if)#security-level 0
NERDCAFE-FW(config-if)#exit
NERDCAFE-FW(config)#interface gigabitEthernet 1/3
NERDCAFE-FW(config-if)#no shutdown 
NERDCAFE-FW(config-if)#ip address 10.10.10.1 255.255.255.0
NERDCAFE-FW(config-if)#nameif DMZ
INFO: Security level for "DMZ" set to 0 by default.
NERDCAFE-FW(config-if)#security-level 70
NERDCAFE-FW(config-if)#write memory
Building configuration...
Cryptochecksum: 07b504a4 13fe24f0 00cb1e14 5cde20fc

1253  bytes copied in 2.208 secs (567 bytes/sec)
[OK]
NERDCAFE-FW(config-if)#

Step 3: Automated IP Assignment (DHCP)

To save time, the ASA can automatically give IP addresses to your internal PCs.

NERDCAFE-FW(config)#dhcpd address 192.168.100.101-192.168.100.200 INSIDE 
NERDCAFE-FW(config)#dhcpd dns 8.8.8.8
NERDCAFE-FW(config)#dhcpd enable INSIDE 

Step 4: Secure Remote Management (SSH)

Instead of standing next to the firewall with a cable, you can manage it from your PC securely.

• Use the local 'admin' user we created in Step 1 for SSH login

NERDCAFE-FW(config)#aaa authentication ssh console LOCAL

• Generate encryption keys so your management session is secret

NERDCAFE-FW(config)#crypto key generate rsa modulus 1024
WARNING: You have a RSA keypair already defined named <Default-RSA-Key>.

Do you really want to replace them? [yes/no]: y
Keypair generation process begin. Please wait...
NERDCAFE-FW(config)#

• ONLY allow PCs on the 192.168.100.0 network to connect to the 'inside' port

NERDCAFE-FW(config)#ssh 192.168.100.0 255.255.255.0 inside

Step 5: Access Control Lists (The "Rules")

Since the "Outside" has a security level of 0, it can't talk to anyone. We must create an ACL to permit specific traffic, like allowing people to "Ping" (test) our servers.

• Create a list named 'DMZ-Rules' that allows ICMP (Ping) to the DMZ servers

NERDCAFE-FW(config)#access-list DMZ-Rules extended permit icmp any any

• Create a rule to allow Web Traffic (Port 80)

NERDCAFE-FW(config)#access-list DMZ-Rules extended permit tcp any any eq 80

• Apply this list to the OUTSIDE interface so it checks incoming traffic

NERDCAFE-FW(config)#access-group DMZ-Rules in interface outside

Step 6: Network Address Translation (NAT)

Your internal PCs use "Private" IPs (192.168...) that don't work on the public internet. NAT translates them into the ASA's public IP so they can browse the web.

• Create an 'Object' representing your inside network

Perimeter-ASA(config)# object network internal-lan
Perimeter-ASA(config-network-object)# subnet 192.168.100.0 255.255.255.0

• Tell the ASA: When traffic goes from Inside to Outside, hide it behind the outside IP

Perimeter-ASA(config-network-object)# nat (inside,outside) dynamic interface

Step 7: Saving Your Work

Unlike a computer, changes on an ASA are only in "temporary memory." You must save them so they stay after a reboot.

Perimeter-ASA# write memory    ! Saves everything to permanent storage
Perimeter-ASA# show running-config ! Use this to see all your current settings 

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

Channel Overview

🌐 Website: www.nerd-cafe.ir

📺 YouTube: @nerd-cafe

🎥 Aparat: nerd_cafe

📌 Pinterest: nerd_cafe

📱 Telegram: @nerd_cafe

📝 Blog: Nerd Café on Virgool

💻 GitHub: nerd-cafe