CloudLabBox
Try the free demo

Cisco ASA lab 1 of 15

ASA initial setup: interfaces, security levels and the default policy

Bring a new Cisco ASA online with inside, outside and DMZ interfaces, a default route and ICMP inspection, then prove exactly what the security levels allow and block before a single ACL exists.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 01 - ASA initial setup - interfaces security levels and the default policy

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 45 minutes
Nodes need
4 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

Kestrel Logistics is replacing the access lists on its old head-office router with a Cisco ASA, HQ-FW. The cabling is done: Gi0/0 goes to the office LAN, Gi0/1 to the ISP and Gi0/2 to a small DMZ that holds the public web server.

Your job today is the first day of any firewall project: bring the interfaces up with the right trust levels, give the firewall a default route, and prove what the firewall does on its own, before anyone writes an access list. In later labs you will add ACLs, NAT, VPNs and more on top of exactly this design.

InterfaceNameSecurity levelAddress
Gi0/0inside10010.10.10.1/24
Gi0/1outside0203.0.113.2/24
Gi0/2dmz50172.16.10.1/24

For this first lab only, the ISP routes Kestrel's internal ranges back to the firewall, so you can watch the security levels work without NAT. Lab 4 replaces that shortcut with NAT.

What you’ll practise

  • Name ASA interfaces and give them security levels that match their trust
  • Explain and test the default policy: higher to lower allowed, lower to higher denied
  • Add a default route and read the ASA routing table
  • Turn on ICMP inspection in the global policy and explain why ping failed without it
  • Read the connection table and syslog messages 106001 and 106014

The tasks

  1. Look around
  2. Configure the three interfaces
  3. Add the default route
  4. Test outbound traffic and fix ping
  5. Prove what is blocked
  6. Save your work

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of ASA initial setup - interfaces security levels and the default policy4 nodes, 3 links. Every link is listed as text below the diagram.HQ-FWPC1WEBISPGi0/1Gi0/0Gi0/0Gi0/0Gi0/2Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Gi0/2 to WEB Gi0/0
Nodes in ASA initial setup: interfaces, security levels and the default policy, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WEBCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 01 - ASA initial setup - interfaces security levels and the default policy and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.