CloudLabBox
Try the free demo

Cisco ASA lab 15 of 15

Capstone: build HQ-FW from scratch and connect the branch

A replacement ASA arrives with nothing but a hostname. From a design brief and the branch MSP's handover note, build interfaces, routing, secure management, NTP, NAT, access rules, inspection and an IKEv2 VPN with GCM, then prove every requirement.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 4,608 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 15 - Capstone - build HQ-FW from scratch and connect the branch

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
6 vCPU, 4,608 MB
Smallest plan
Lite

The scenario

HQ-FW failed over the weekend and the replacement ASA has arrived with only a hostname. There is no backup of the old configuration (a lesson for another day), but there is a design brief and the branch MSP's handover note. Rebuild HQ-FW so that every requirement below is met, then prove it. Use the earlier labs as your reference; the hints are deliberately brief.

Design brief

#Requirement
1Gi0/0 inside 10.10.10.1/24 (100); Gi0/1 outside 203.0.113.2/24 (0); Gi0/2 dmz 172.16.10.1/24 (50). Default route via 203.0.113.1.
2Local admin admin / Kestrel-Admin-26, level 15. SSH v2 with a 2048-bit RSA key, only from 10.10.10.0/24 on inside, authenticated locally; admins land in privileged mode.
3Buffered logging at informational with timestamps. NTP from 198.51.100.10 with MD5 key 1 Kestrel-NTP-26, authenticated time only.
4Office and DMZ reach the internet with PAT to the outside address. WEB (172.16.10.10) is published as 203.0.113.10 on TCP 80 only.
5From the internet, only HTTP to WEB is allowed; everything else is denied and logged.
6Ping and traceroute work from the office (ICMP inspection).
7Site-to-site VPN to the branch with the MSP's parameters below. Branch and HQ LANs talk untranslated.

MSP handover note (branch side, already configured)

SettingBranch value
Peer192.0.2.2 (BRANCH) to 203.0.113.2 (HQ-FW), IKEv2, PSK Kestrel-Branch-26
IKE SAAES-CBC-256, SHA-384 integrity (PRF follows integrity), DH group 20
IPsec SAESP AES-GCM-256 (no separate integrity), PFS group 20, 3,600 s
Protected networks10.20.20.0/24 to 10.10.10.0/24

What you’ll practise

  • Turn a written design into a complete ASA configuration without step-by-step guidance
  • Match a third party's VPN parameters exactly, including AES-GCM and DH group 20
  • Order NAT correctly so VPN, PAT and static PAT coexist
  • Verify a firewall end to end with show commands, packet-tracer and real traffic

The Lab Tasks pane has the scenario, the tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - build HQ-FW from scratch and connect the branch6 nodes, 5 links. Every link is listed as text below the diagram.HQ-FWPC1WEBISPBRANCHBR-PCGi0/2Gi0/0Gi0/1Gi0/0Gi0/1Gi0/0Gi0/0Gi0/0Gi0/1Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Gi0/2 to WEB Gi0/0
  • ISP Gi0/1 to BRANCH Gi0/0
  • BRANCH Gi0/1 to BR-PC Gi0/0
Nodes in Capstone: build HQ-FW from scratch and connect the branch, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WEBCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BRANCHCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
BR-PCCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 15 - Capstone - build HQ-FW from scratch and connect the branch and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.