Cisco ASA Initial Setup with NAT and ACLs

The Cisco Adaptive Security Appliance (ASA) remains a prevalent firewall platform in many enterprise and service provider environments, particularly for…

The Cisco Adaptive Security Appliance (ASA) remains a prevalent firewall platform in many enterprise and service provider environments, particularly for its robust stateful inspection capabilities and mature feature set. This article details the fundamental steps for configuring a new Cisco ASA, focusing on interface setup, basic Network Address Translation (NAT) for internal users, and Access Control Lists (ACLs) to manage traffic flow.

Initial Device Access and Basic Configuration

Before any configuration, ensure console access is established. A common method is using a serial console cable (RJ-45 to DB9) connected to the console port at 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

Upon boot, the ASA may enter ROMMON mode if the configuration or boot image is missing. Assuming a functional OS, you'll reach the asa> prompt. Enter privileged EXEC mode and then global configuration mode:

enable
password (if set, default is usually blank or "cisco")
configure terminal

Set a hostname and enable password for security:

hostname ASA-FW01
enable password <your_strong_password>
passwd <your_strong_password> (for console password)
aaa authentication enable console LOCAL

It's also good practice to configure logging to a buffer or an external syslog server:

logging enable
logging timestamp
logging buffer informational
logging trap informational
logging host outside <syslog_server_ip> transport udp port 514

Interface Configuration and Security Levels

Cisco ASA interfaces are assigned a nameif and a security-level. The security level is a value from 0 (lowest, typically Internet-facing) to 100 (highest, typically internal networks). Traffic can flow from a higher security level to a lower one by default, but not vice-versa without explicit ACLs.

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute
 no shutdown

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 no shutdown

interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
 no shutdown

Note: Using ip address dhcp setroute on the outside interface is convenient for initial setup but is generally not recommended for production environments where a static IP is preferred for predictability and control.

Verify interface status:

show interface ip brief

Network Address Translation (NAT)

NAT is crucial for allowing internal private IP addresses to access external networks (like the Internet) using a public IP. The ASA supports various NAT types, but the most common for outbound traffic is dynamic PAT (Port Address Translation) to the outside interface IP.

Object NAT (Auto NAT) for Internal Networks

This method uses network objects to define the source and destination networks and then applies NAT rules directly to these objects. It's the recommended approach since ASA software version 8.3.

object network INSIDE-NET
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

object network DMZ-NET
 subnet 172.16.1.0 255.255.255.0
 nat (dmz,outside) dynamic interface

The dynamic interface keyword tells the ASA to use the IP address of the outside interface for NAT translation. This is the simplest and most common scenario.

Static NAT for Inbound Services (e.g., Web Server)

For services hosted on your internal network that need to be accessible from the outside, you'll configure static NAT. This maps a public IP address (or a specific port on a public IP) to a private internal IP and port.

object network WEB-SERVER-INTERNAL
 host 192.168.1.100
 nat (inside,outside) static <public_ip_for_web_server>

object service HTTP-80
 service tcp source eq 80

object service HTTPS-443
 service tcp source eq 443

object network WEB-SERVER-EXTERNAL
 host <public_ip_for_web_server>

access-list OUTSIDE_IN extended permit tcp any host 192.168.1.100 eq 80
access-list OUTSIDE_IN extended permit tcp any host 192.168.1.100 eq 443
access-group OUTSIDE_IN in interface outside

Note: The NAT rule nat (inside,outside) static <public_ip_for_web_server> does the IP address translation. The ACL then permits the traffic. The ACL targets the real (private) IP address of the server, as NAT occurs before ACL evaluation on inbound traffic to the ASA's outside interface.

Access Control Lists (ACLs)

ACLs are used to filter traffic based on source/destination IP, port, and protocol. They are applied to interfaces with an access-group command.

Basic Outbound Access from Inside to Outside

By default, traffic can flow from a higher security level to a lower one. However, if you need to restrict outbound traffic, an ACL is required. For example, to only allow HTTP/HTTPS from the inside:

access-list INSIDE_OUT extended permit tcp 192.168.1.0 255.255.255.0 any eq 80
access-list INSIDE_OUT extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
access-list INSIDE_OUT extended permit tcp 192.168.1.0 255.255.255.0 any eq 53
access-list INSIDE_OUT extended permit udp 192.168.1.0 255.255.255.0 any eq 53
access-group INSIDE_OUT in interface inside

Important: The access-group command specifies the ACL and the direction (in or out) relative to the interface. For traffic originating from the inside network and going out to the outside, the ACL is applied in on the inside interface. This is because the traffic is "entering" the ASA from the inside interface. This can be confusing initially.

Inbound Access to Internal Services

As shown in the static NAT example, ACLs are essential to permit inbound traffic from lower security interfaces (like outside) to higher security interfaces (like inside or dmz).

access-list OUTSIDE_IN extended permit tcp any host 192.168.1.100 eq 80
access-list OUTSIDE_IN extended permit tcp any host 192.168.1.100 eq 443
access-list OUTSIDE_IN extended permit icmp any any echo-reply (for allowing ping replies from internal hosts)
access-group OUTSIDE_IN in interface outside

The echo-reply rule allows the ASA to pass ICMP replies from inside hosts back to the outside, which is important for basic connectivity troubleshooting. It does not allow ping initiations from the outside to the inside.

ACLs Between Internal Networks (e.g., DMZ to Inside)

If you have a DMZ and want to allow specific access from DMZ servers to internal resources (e.g., database), you'll need an ACL on the DMZ interface.

object network DB-SERVER
 host 192.168.1.200

access-list DMZ_TO_INSIDE extended permit tcp 172.16.1.0 255.255.255.0 host 192.168.1.200 eq 3306
access-group DMZ_TO_INSIDE in interface dmz

Default Route Configuration

For the ASA to send traffic to the Internet or other external networks, a default route is necessary. This typically points to the upstream router or ISP gateway.

route outside 0.0.0.0 0.0.0.0 <ISP_Gateway_IP> 1

The 1 at the end is the metric. Lower metrics are preferred. If you used ip address dhcp setroute, a default route might already be present, but explicitly defining it is better for static IP configurations.

show route

to verify the routing table.

Verifying and Saving Configuration

After making changes, always verify connectivity and functionality. Use commands like ping, packet-tracer, and show commands.

show run: Display the current running configuration.
show nat detail: Show detailed NAT translation information.
show access-list: Display configured ACLs.
show conn: Show active connections through the firewall.
packet-tracer input inside tcp 192.168.1.10 5000 outside 8.8.8.8 80 detail: Simulate traffic flow through the ASA to see how it's handled by NAT, ACLs, and routing.

Once you are satisfied with the configuration, save it to NVRAM so it persists across reboots:

write memory

Or its alias:

copy running-config startup-config

Common Pitfalls and Troubleshooting

ACL Direction Confusion: Remember that an ACL applied in on an interface filters traffic entering the ASA from that interface. An ACL applied out filters traffic leaving the ASA through that interface. Most filtering happens in.
Implicit Deny: Every ACL has an implicit deny ip any any at the end. If traffic isn't explicitly permitted, it will be dropped.
Security Level Behavior: Traffic from lower security to higher security is blocked by default. You must use an ACL to permit this. Traffic from higher to lower is permitted by default.
NAT Order of Operations (Pre/Post NAT):
- Inbound (outside to inside): Pre-NAT ACLs evaluate against the destination public IP. Post-NAT ACLs (applied on the inside interface, effectively) evaluate against the destination private IP. The primary ACL on the outside interface uses the real (private) IP of the internal host for inbound traffic. This is a common source of error.
- Outbound (inside to outside): Pre-NAT ACLs evaluate against the source private IP. Post-NAT ACLs (applied on the outside interface, effectively) evaluate against the source public (translated) IP.
The packet-tracer command is invaluable for understanding the exact order of operations for a specific traffic flow.
Missing Default Route: Without a default route, the ASA cannot send traffic to destinations not explicitly in its routing table, leading to one-way connectivity or no connectivity.
ASDM vs CLI: While ASDM (Adaptive Security Device Manager) provides a GUI, understanding the CLI is fundamental for advanced troubleshooting and scripting. Some features might also require CLI configuration initially.
Interface State: Always ensure interfaces are no shutdown.