IN and OUT directions can be confusing :),for better understanding go to Īlternativelly,we can use Modular Policy Framework (MPF) to enable ICMP trafficĪ class map identifies traffic to which we want to apply actions (we created class map named icm-traffic-we can set any name we want):ĭefault class map is called default-inspection-traffic.The “default_inspection_traffic” is all traffic that is predefined for various protocols,among them ICMP.

!apply this ACL to the traffic flowing from the inside network IN to the outside interfaceĬiscoasa(config)#access-group 102 in interface outside !echo reply comes from location we pinged (any) so we allowed ICMP reply from internet !(any) to our internal-'inside' network (192.168.3.0):Ĭiscoasa(config)#access-list 102 extended permit icmp any 192.168.3.0 255.255.255.0 echo-reply !create access lists to allow traffic from 'inside' (192.168.3.0) to the internet (any),unlike !CISCO router and switches,for ASA access lists we must use real network masksĬiscoasa(config)#access-list 102 extended permit icmp 192.168.3.0 255.255.255.0 any echo R1(config)#ip nat inside source list 5 interface FastEthernet0/0 overload R1(config)#ip nat inside source list 4 interface FastEthernet0/0 overload

R1(config)#ip nat inside source list 3 interface FastEthernet0/0 overload !nat rules R1(config-router)#redistribute static !advertise route to the internet to all EIGRP neighbors See for connecting GNS3 router to the internet R1(config)#int fa0/0 In this example inside interface has IP address of 192.168.2.2 and outside 209.’ll configure ASA to alow ping from client1 to the internet,we’ll also configure NAT on ASA,so when client access to the internet,from the outside perspective it would appear as if traffic comes from ASA’s outside interface. For an inside interface, the default security level is 100.If we need to publish services to the internet the we would use another interface named DMZ (demilitarized zone) with default security level of 50 The default security level for an outside interface is 0. We use Access-lists to permit traffic from lower security levels to higher security levels. Traffic is permitted from interfaces with higher security levels to interfaces with lower security levels, but not the opposite. Interfaces have associated security levels It’s numeric value, ranging from 0 to 100, used by the ASA to control traffic flow. Inside interface is connected to internal network,and outside interface to public network. An ASA can be used as a security solution for both small and large networks.īy default,ASA doesn’t allow ICMP from inside to outside interface.

Cisco ASA (Adaptive Security Appliance) is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities.

Asa gns3