Skip to main content

Cisco ASA Cli

Static NAT (SNAT)

object network obj- 
nat (inside,outside) static dns


Allow outside connections targeting TCP port 80 to redirect to internal port 8080.

object network obj-
nat (inside,outside) static service tcp 8080 http


In the example bellow, the subnet will be on a port channel named inside2 and will have a obj-group called net-local2

interface port-channel 150
nameif inside2
security-level 100
ip address
object-group network net-local2

after-auto Inserts the rule at the end of section.
You can translate all addresses on the source interface by specifying source dynamic any mapped_obj

nat (inside2,outside) after-auto source dynamic net-local2 interface dns

PAT connections will be visible in show xlate

fw1# show xlate
TCP PAT from inside2: to outside: flags riD
idle 0:05:37 timeout 0:00:30

For more advanced configs, refer to article below:

Configuring Static PAT as a Twice NAT/Manual NAT

object network local-

object network external-

object service https
service tcp source eq https

object service tcp_8443
service tcp source eq 8443
nat (inside,outside) source static local- external- service tcp_8443 https

DHCP Server

dhcpd address inside
dhcpd dns
dhcpd enable inside


asdm image disk0:/asdm-X.bin
http server enable 8080
http <whitelist-ip> OUTSIDE
username admin password PASSWORD privilege 15
https://<asa ip>:8080

Allow non-connected subnets

arp permit-nonconnected

The ASA ARP cache only contains entries from directly-connected subnets by default. You can enable the ARP cache to also include non-directly-connected subnets. We do not recommend enabling this feature unless you know the security risks. This feature could facilitate denial of service (DoS) attack against the ASA; a user on any interface could send out many ARP replies and overload the ASA ARP table with false entries.

You may want to use this feature if you use:

  • Secondary subnets.

  • Proxy ARP on adjacent routes for traffic forwarding.

Route LAN to remote subnet on physical port

interface GigabitEthernet1/8
  description remote
  no nameif
  no security-level
  no ip address

interface GigabitEthernet1/8.100
  description Public VLAN 100 remote
  vlan 100
  nameif remote
  no security-level
  ip address
object network local-net
object network remote-net
access-list inbound extended permit ip object local-net object remote-net
nat (inside,remote) source static local-net local-net destination static remote-net remote-net

route remote 1

In this example you will be able to connect to "" from your local "" subnet using the port, the remote port will be on the same vlan using the IP

Object Groups ASA

object-group service http-https tcp
port-object eq www
port-object eq https
object-group network webservers
network-object host
network-object host
network-object host
access-list OUTSIDE-IN extended permit tcp any object-group webservers object-group http-https
access-group OUTSIDE-IN in interface outside


packet-tracer input inside icmp 8 0
packet-tracer input outside tcp 80 80


Create a Backup 

copy running-config disk0:/backup-2017-00-00

Restore a backup

copy disk0:/backup-2017-08-18 startup-config

Allow FTP passive ports

The firewall will block this data communication because it will start from a different source port (20 instead of 21). The purpose therefore of the inspect ftp command on the Cisco ASA is to listen for the initial Command FTP traffic (on port 21) and dynamically open a secondary Data connection between FTP server and client (from port 20). This will allow FTP communication to work. If you disable FTP inspection with the no inspect ftp command, outbound users can start connections only in passive mode, and all inbound FTP is disabled.

policy-map global_policy
 class inspection_default
  no inspect ftp

Mitigating attack traffic


First of all we define which traffic the MPF policy will be applied to. In the example below we exclude the host whilst inspecting all other traffic.

access-list mpf-policy-acl extended permit ip any any

Next we assign the previously created access-list to a class-map.

class-map mpf-policy
match access-list mpf-policy-acl

Then a policy-map is created and the necessary connection limits defined.

policy-map mpf-policy-map
class mpf-policy
set connection conn-max 9500
set connection embryonic-conn-max 5000
set connection per-client-embryonic-max 100
set connection per-client-max 300

Allow LAN management over VPN

management-access inside
nat (inside,any) source static obj-LANSUBNET obj-LANSUBNET destination static obj-VPNSUBNET obj-VPNSUBNET route-lookup
http <VPNSUBNET> inside
ssh <VPNSUBNET> inside


To run on the Standby FW

failover active

Licensing Info

Different ASA models have different licensing options. To see what the limits of the active license, use the following:

sh version