CloudLabBox
Try the free demo

Cisco ASA firewall practice labs

15 guided labs on a Cisco ASAv 9.22 firewall: interfaces and security levels, secure management, ACLs, object and twice NAT, routing with tracking, the Modular Policy Framework, site-to-site, route-based and remote-access VPNs, failover, AAA, transparent mode and packet-tracer troubleshooting, ending in a capstone build.

Start this courseTry it free for 30 minutes

Lite for a month, £45.00, runs every lab here, with nothing extra to pay for the guided labs. Every lab here also runs in the free demo.

Guided labs
15
Follows
Cisco SCOR 350-701 (v2.0), firewall and VPN topics
Runs every lab
Lite
Devices
IOSv, ASAv and Alpine Linux

Who these labs are for

For network and security engineers preparing for the firewall and VPN topics of SCOR 350-701, and anyone who runs Cisco ASA or Secure Firewall in production: Secure Firewall Threat Defense uses the ASA engine to forward traffic, so the packet-tracer, capture, NAT and crypto skills carry over.

The routers around the firewall are Cisco IOSv, with Alpine Linux hosts. EVE-NG applies the firewall’s starting configuration during boot, so its first start takes about 4 minutes 20 seconds. Wait for the hostname prompt: pasting the configuration from the pane is only the fallback.

The 15 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Cisco ASA firewall course 15 labs

Shared folderCisco ASA Firewall SCOR 350-701 guided labs

One ASA topic per lab, ending in a capstone that builds the headquarters firewall from scratch and connects the branch.

  1. 01ASA initial setup - interfaces security levels and the default policy

    Bring a new Cisco ASA online with inside, outside and DMZ interfaces, a default route and ICMP inspection, then prove exactly what the security levels allow and block before a single ACL exists.

    3× IOSv, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  2. 02Secure management - out-of-band access SSH NTP authentication syslog and SNMPv3

    Build a hardened management plane on HQ-FW: an out-of-band management interface, local admin accounts with SSH, authenticated NTP from the ISP, syslog to a collector and SNMPv3 with authentication and encryption.

    2× IOSv, 1× Alpine Linux, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  3. 03Access control lists objects and object groups

    Publish the DMZ web server to the internet, restrict what inside users may do, and lock down the DMZ with a global ACL, using network and service objects, object groups, remarks, logging and hit counts.

    4× IOSv, 1× ASAv

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  4. 04Object NAT - dynamic PAT static NAT and port forwarding

    Give the office and the DMZ internet access with interface PAT, publish the web server with static NAT, then tighten it to port-specific static PAT, reading every translation with show nat, show xlate and packet-tracer.

    3× IOSv, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  5. 05Twice NAT and NAT order - identity NAT policy PAT and destination NAT

    Meet three partner and user requirements that object NAT cannot express, with manual (twice) NAT: identity NAT for one partner, a dedicated PAT address for another, and destination NAT so staff reach the web server by its public address. Then break and fix the NAT order on purpose.

    3× IOSv, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  6. 06Routing on the ASA - authenticated OSPF dual ISPs and SLA-tracked default routes

    Run OSPF with MD5 authentication between HQ-FW and the core router, add a second ISP, and make the default route fail over automatically when an SLA probe through ISP1 stops answering, with PAT on both ISP links.

    4× IOSv, 1× ASAv

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  7. 07Modular Policy Framework - inspection connection limits HTTP policy and threat detection

    Use the Modular Policy Framework to make HQ-FW visible in traceroute, protect the published web server with connection limits, drop dangerous HTTP requests with an application inspection policy, and watch attacks with threat detection and shun.

    3× IOSv, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  8. 08Site-to-site VPN - IKEv2 crypto map between the ASA and an IOS router

    Connect the Kestrel branch office to HQ with a policy-based IKEv2 IPsec VPN between HQ-FW and the branch IOS router, exempt the VPN from PAT, verify both IKE and IPsec SAs, and troubleshoot a proposal mismatch.

    4× IOSv, 1× ASAv

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  9. 09Route-based VPN - a virtual tunnel interface with BGP over IPsec

    Replace crypto-ACL thinking with routing: build an IKEv2 virtual tunnel interface (VTI) between HQ-FW and the branch router, run eBGP across it, and add a new branch subnet without touching the IPsec configuration.

    4× IOSv, 1× ASAv

    5 vCPU, 4,096 MBFits LiteRuns in the free demo

  10. 10Remote-access VPN headend - Secure Client SSL and IKEv2 on the ASA

    Prepare HQ-FW to accept Cisco Secure Client (AnyConnect) users over TLS and IKEv2: a certificate trustpoint, an address pool, a split-tunnel group policy, a connection profile, local VPN-only users and the NAT exemption, then verify the portal and certificate from a remote host on the internet.

    2× IOSv, 1× Alpine Linux, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  11. 11High availability - Active-Standby failover with stateful replication

    Pair HQ-FW with a second ASAv as an Active/Standby failover pair: standby addresses, a dedicated failover link and a stateful link, configuration replication, interface monitoring, a controlled failover and the commands to read the pair's health.

    2× ASAv, 2× IOSv

    4 vCPU, 5,120 MBFits LiteRuns in the free demo

  12. 12AAA for device access - RADIUS with local fallback privilege levels and troubleshooting

    A half-finished AAA change has locked the admins out of HQ-FW's SSH. Find and fix the faults, make RADIUS fall back to the local database while the server is down, give the helpdesk a read-only privilege level with local command authorisation, and add a lockout policy.

    1× Alpine Linux, 1× ASAv, 1× IOSv

    3 vCPU, 3,072 MBFits LiteRuns in the free demo

  13. 13Troubleshooting with packet-tracer captures and ASP drops

    A weekend change broke both the office's internet access and the public web site. Use packet-tracer, packet captures, ASP drop captures, ARP, NAT and connection tables to find four separate faults (three on the firewall, one on the server) and prove each fix.

    3× IOSv, 1× ASAv

    4 vCPU, 3,584 MBFits LiteRuns in the free demo

  14. 14Transparent - Layer 2 firewall - bridge groups BVI and letting OSPF through

    Insert an ASA into an existing routed link without re-addressing anything: switch to transparent mode, bridge inside and outside in one bridge group, manage it through a BVI, then write the ACLs that let OSPF and a web service through while everything else stays blocked.

    2× IOSv, 1× ASAv

    3 vCPU, 3,072 MBFits LiteRuns in the free demo

  15. 15Capstone - build HQ-FW from scratch and connect the branch

    A replacement ASA arrives with nothing but a hostname. From a design brief and the branch MSP's handover note, build interfaces, routing, secure management, NTP, NAT, access rules, inspection and an IKEv2 VPN with GCM, then prove every requirement.

    5× IOSv, 1× ASAv

    6 vCPU, 4,608 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Cisco ASA practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB1545
Cisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB1516
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB33

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Cisco ASA labs

Are these Cisco ASA labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run every one of these labs.

Which plan do I need for these labs?

Lite, with 6 vCPU and 8 GB, runs every lab here. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “High availability - Active-Standby failover with stateful replication”, needs 4 vCPU and 5,120 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Cisco?

No. CloudLabBox wrote them to follow the topics of the firewall and VPN topics of Cisco’s CCNP Security core exam, SCOR 350-701 v2.0. They aren’t training material from Cisco, and CloudLabBox is independent of Cisco.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run every one of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.