Cisco ASA firewall commands: interfaces, NAT, ACLs and VPN
In short: A quick reference of the Cisco ASA commands used to configure a perimeter firewall. Commands only.
Commands only. Replace values in angle brackets such as <ip> with your own. Only run commands on systems you own or are authorised to manage.
Interfaces and security levels
interface gigabitEthernet 0/0
nameif outside
security-level 0
ip address <public-ip> <mask>
no shutdown
interface gigabitEthernet 0/1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
no shutdown
interface gigabitEthernet 0/2
nameif dmz
security-level 50
ip address 172.16.1.1 255.255.255.0
no shutdown
route outside 0.0.0.0 0.0.0.0 <isp-gateway>Management access
hostname ASA1
enable password <strong-secret>
username admin password <strong-secret> privilege 15
aaa authentication ssh console LOCAL
crypto key generate rsa modulus 2048
ssh 192.168.1.0 255.255.255.0 inside
ssh version 2
ssh timeout 10
http server enable
http 192.168.1.0 255.255.255.0 inside
ntp server <ntp-ip>
logging enable
logging host inside <syslog-ip>
logging trap warningsNAT
object network INSIDE-NET
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic interface
object network WEB-SERVER
host 172.16.1.10
nat (dmz,outside) static <public-ip-2>Access rules
access-list OUTSIDE-IN extended permit tcp any object WEB-SERVER eq https
access-list OUTSIDE-IN extended deny ip any any log
access-group OUTSIDE-IN in interface outside
policy-map global_policy
class inspection_default
inspect icmpSite-to-site IPsec VPN (IKEv2)
object network LOCAL-LAN
subnet 192.168.1.0 255.255.255.0
object network REMOTE-LAN
subnet 10.10.0.0 255.255.0.0
access-list VPN-TRAFFIC extended permit ip object LOCAL-LAN object REMOTE-LAN
nat (inside,outside) source static LOCAL-LAN LOCAL-LAN destination static REMOTE-LAN REMOTE-LAN no-proxy-arp route-lookup
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 14
prf sha256
lifetime seconds 86400
crypto ikev2 enable outside
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-256
tunnel-group <peer-ip> type ipsec-l2l
tunnel-group <peer-ip> ipsec-attributes
ikev2 remote-authentication pre-shared-key <psk>
ikev2 local-authentication pre-shared-key <psk>
crypto map OUTSIDE-MAP 10 match address VPN-TRAFFIC
crypto map OUTSIDE-MAP 10 set peer <peer-ip>
crypto map OUTSIDE-MAP 10 set ikev2 ipsec-proposal AES256
crypto map OUTSIDE-MAP interface outsideVerification commands
| Command | Purpose |
|---|---|
show interface ip brief | Interfaces and addresses |
show nameif | Interface names and security levels |
show route | Routing table |
show conn | Active connections through the firewall |
show xlate | Active NAT translations |
show access-list | Access rules with hit counts |
show crypto ikev2 sa | IKEv2 tunnels (phase 1) |
show crypto ipsec sa | IPsec security associations and counters (phase 2) |
packet-tracer input outside tcp 8.8.8.8 1025 <public-ip-2> 443 | Simulate a packet through NAT and rules |
show running-config | Current configuration |
write memory | Save the configuration |
Real-world example: putting a web server in the DMZ
A small software company used a Cisco ASA with three interfaces: inside for staff, dmz for a public web server and outside for the internet. Staff could browse because traffic from the inside (level 100) to the outside (level 0) is allowed by default, with dynamic interface NAT sharing the public address. To publish the web server, the engineer created a network object with static NAT to a second public address and an access rule on the outside interface that permitted only HTTPS to that object.
No rule allowed new connections from the DMZ to the inside. When the web application later had a vulnerability, the attacker could not reach the staff network from the compromised server. The engineer used packet-tracer to prove each rule before going live and saved the configuration after every change.
Key takeaways
- Traffic from higher to lower security levels is allowed by default; the reverse needs an access rule.
- Object NAT keeps NAT next to the object it translates.
- Exempt VPN traffic from NAT with an identity (twice) NAT rule.
- packet-tracer shows exactly which rule or NAT step allows or drops a flow.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.