Lab-Configuring ASA 5505 Basic Settings and Firewall Using CLI

Sep 24, 2026

Uploaded by Ben

CCNA Security lab using an ASA 5505 to build a stateful firewall that protects an internal corporate network while permitting inside hosts to reach the Internet. The scenario defines Outside, Inside, and DMZ security zones and uses Layer 3 VLAN interfaces for access. The lab guides configuration via the ASA CLI, including basic router/switch/PC setup, ASA console access, interface security levels, routing, PAT and inspection policy, DHCP and AAA, SSH/ASDM access, and DMZ deployment with static NAT and ACL-based verification.

LanguageEnglish

CategoryExam

FormatPDF

Pages26

Reading Time1 h 6 min

AccessFree to download

Objectives

Part 1: Basic Router/Switch/PC Configuration

Part 2: Accessing the ASA Console and Using CLI Setup Mode

Part 3: Configuring Basic ASA Settings and Interface Security Levels Using the CLI

Part 4: Configuring Routing, Address Translation, and Inspection Policy Using the CLI

Part 5: Configuring DHCP, AAA, and SSH

Part 6: Configuring DMZ, Static NAT, and ACLs

Background/Scenario

CCNA Security Lab-Configuring ASA 5505 Basic Settings and Firewall Using CLI Topology Note: ISR G2 devices use GigabitEthernet interfaces instead of FastEthernet interfaces. IP Addressing Table | Device | Interface | IP Address | Subnet Mask | Default Gateway | Switch Port | | --- | --- | --- | --- | --- | --- | | R1 | G0/0 | [209.165.200.225](209.165.200.225) | [255.255.255.248](255.255.255.248) | N/A | ASA E0/0 | | | S0/0/0 (DCE) | [10.1.1.1](10.1.1.1) | [255.255.255.252](255.255.255.252) | N/A | N/A | | R2 | S0/0/0 | [10.1.1.2](10.1.1.2) | [255.255.255.252](255.255.255.252) | N/A | N/A | | | S0/0/1 (DCE) | [10.2.2.2](10.2.2.2) | [255.255.255.252](255.255.255.252) | N/A | N/A | | R3 | G0/1 | [172.16.3.1](172.16.3.1) | [255.255.255.0](255.255.255.0) | N/A | S3 F0/5 | | | S0/0/1 | [10.2.2.1](10.2.2.1) | [255.255.255.252](255.255.255.252) | N/A | N/A | | ASA | VLAN 1 (E0/1) | [192.168.1.1](192.168.1.1) | [255.255.255.0](255.255.255.0) | NA | S2 F0/24 | | ASA | VLAN 2 (E0/0) | [209.165.200.226](209.165.200.226) | [255.255.255.248](255.255.255.248) | NA | R1 G0/0 | | ASA | VLAN 3 (E0/2) | [192.168.2.1](192.168.2.1) | [255.255.255.0](255.255.255.0) | NA | S1 F0/24 | | PC-A | NIC | [192.168.2.3](192.168.2.3) | [255.255.255.0](255.255.255.0) | [192.168.2.1](192.168.2.1) | S1 F0/6 | | PC-B | NIC | [192.168.1.3](192.168.1.3) | [255.255.255.0](255.255.255.0) | [192.168.1.1](192.168.1.1) | S2 F0/18 | | PC-C | NIC | [172.16.3.3](172.16.3.3) | [255.255.255.0](255.255.255.0) | [172.16.3.1](172.16.3.1) | S3 F0/18 | Objectives Part 1: Basic Router/Switch/PC Configuration 􀁸 Cable the network as shown in the topology. 􀁸 Configure hostnames and interface IP addresses for routers, switches, and PCs. 􀁸 Configure static routing, including default routes, between R1, R2, and R3 . 􀁸 Enable [HTTP](HTTP) and SSH access for R1 . 􀁸 Configure PC host IP settings. 􀁸 Verify connectivity between hosts, switches , and routers. 􀁸 Save the basic running configuration for each router and switch. Part 2: Accessing the ASA Console and Using CLI Setup Mode to Configure Basic Settings 􀁸 Access the ASA console and view hardware, software, and configuration settings. 􀁸 Determine the ASA version, interfaces, and license. 􀁸 Determine the file system and contents of flash memory. 􀁸 Use CLI Setup mode to configure basic settings (hostname, passwords, clock, etc. ) . Part 3: Configuring Basic ASA Settings and Interface Security Levels Using the CLI. 􀁸 Configure the hostname and domain name. 􀁸 Configure the login and enable passwords. 􀁸 Set the date and time. 􀁸 Configure the inside and outside interfaces. 􀁸 Test connectivity to the ASA. 􀁸 Configure SSH access to the ASA. 􀁸 Configure [HTTPS](HTTPS) access on the ASA for ASDM. Part 4: Configuring Routing, Address Translation, and Inspection Policy Using the CLI 􀁸 Configure a static default route for the ASA. 􀁸 Configure PAT and network objects. 􀁸 Modify the MPF application inspection global service policy. Part 5: Configuring DHCP, AAA, and SSH 􀁸 Configure the ASA as a DHCP server/client. 􀁸 Configure Local AAA user authentication. 􀁸 Configure SSH remote access to the AAA. Part 6: Configuring DMZ, Static NAT, and ACLs 􀁸 Configure the DMZ interface VLAN 3 on the ASA. 􀁸 Configure static NAT for the DMZ server using a network object. 􀁸 Configure an ACL to allow access to the DMZ for Internet users. 􀁸 Verify access to the DMZ server for external and internal users. Background/Scenario The Cisco Adaptive Security Appliance (ASA) is an advanced network security device that integrates astateful firewall, VPN, and other capabilities. This lab employs an ASA 5505 to create a firewall and protect an internal corporate network from external intruders while allowing internal hosts access to the Internet. The ASA creates three security interfaces: Outside, Inside, and DMZ. It provides outside users limited access to the DMZ and no access to inside resou

FAQs

What are the main security interfaces and traffic expectations in this ASA lab scenario?

The ASA creates three security interfaces: Outside, Inside, and DMZ. Outside users get limited access to the DMZ and no access to inside resources, while Inside users can access the DMZ and Outside resources.

Which tasks are covered for the ASA using CLI setup mode?

The lab includes accessing the ASA console to view hardware, software, and configuration details, checking the ASA version, interfaces, and license, examining flash contents, and using CLI Setup mode for basic settings such as hostname, passwords, and clock.

What components are configured in Part 6 to provide DMZ access?

Part 6 configures the DMZ interface VLAN 3, sets up static NAT for the DMZ server using a network object, creates an ACL to allow DMZ access for Internet users, and verifies access for external and internal users.

Sep 24, 2026

Uploaded by Ben