Securing Networks with ASA Fundamentals

Course description
The Cisco ASA 5500 Series Adaptive Security Appliance delivers converged firewall, IPS, network antivirus, and VPN services. As a key component of the Cisco Self-Defending Network, it provides proactive threat mitigation that stops attacks before they spread, controls network activity and application traffic, and delivers flexible VPN connectivity.

This task-oriented course teaches the knowledge and skills needed to configure, maintain, and operate Cisco ASA 5500 Series appliances.

Note: This course replaces the Securing Networks with PIX and ASA (SNPA) course.


Learning objectives
After you complete this course, you will be able to:

• Identify the Cisco ASA and PIX security appliance models
• Explain the Cisco ASA security appliance licensing options
• Configure the security appliance for basic network connectivity
• Configure NAT
• Configure ACLs and content filtering
• Configure object grouping
• Configure switching and routing functionality
• Define, configure, and monitor AAA
• Configure a modular policy
• Configure advanced protocol handling
• Configure Threat Detection
• Configure Site-to-Site VPNs
• Configure Remote-Access VPNs
• Configure SSL VPNs
• Configure Transparent Firewall Mode
• Configure the security appliance to support multiple contexts
• Configure failover
• Secure and upgrade system access

Who should attend
This course is designed for anyone tasked with implementing or maintaining a secure network using Cisco ASA firewalls. Candidates seeking the Cisco CCSP security certification must also take this course.


Recommended prerequisites

• CCNA certification or equivalent knowledge
• Basic knowledge of the Windows operating system
• Securing Cisco Network Devices (SND)

Course outline
Lesson 1: Introducing Cisco Security Appliance Technology and Features

• Firewalls
• Security Appliance Essentials

Lesson 2: Introducing the Cisco ASA and PIX Security Appliance Families

• Models and Features of Cisco Security Appliances
• Cisco ASA Security Appliance Licensing

Lesson 3: Getting Started with Cisco Security Appliances

• User Interface
• File Management
• Security Appliance Security Levels
• Cisco ASDM Essentials and Operating Requirements
• Preparing to Use Cisco ASDM
• Navigating Cisco ASDM Windows

Lesson 4: Configuring a Security Appliance

• Basic Security Appliance Configuration
• Examining Security Appliance Status
• Time Setting and NTP Support
• Syslog Configuration

Lesson 5: Configuring Translations and Connection Limits

• Transport Protocols
• Understanding NAT
• Understanding PAT
• Static Translations
• TCP SYN Cookies and Connection Limits
• Connections and Translations

Lesson 6: Using ACLs and Content Filtering

• ACL Configuration
• Malicious Active Code Filtering
• URL Filtering
• Packet Tracer

Lesson 7: Configuring Object Grouping

• Essentials of Object Grouping
• Configuring and Using Object Groups

Lesson 8: Switching and Routing on Cisco Security Appliances

• VLAN Capabilities
• Static Routing
• Dynamic Routing

Lesson 9: Configuring AAA for Cut-Through Proxy

• Introduction to AAA
• Configuring the Local User Database
• Installation of Cisco Secure ACS for Windows 2000
• Cut-Through Proxy Authentication Configuration
• Authentication Prompts and Timeouts
• Authorization Configuration
• Accounting Configuration

Lesson 10: Configuring the Cisco Modular Policy Framework

• Modular Policy Framework Overview
• Class Map Overview
• Policy Map Overview
• Configuring Modular Policies with Cisco ASDM
• Configuring a Policy for Management Traffic
• Displaying Modular Policy Framework Components

Lesson 11: Configuring Advanced Protocol Handling

• Advanced Protocol Handling
• Protocol Application Inspection
• Multimedia Support

Lesson 12: Configuring Threat Detection

• Threat Detection Overview
• Basic Threat Detection
• Scanning Threat Detection
• Configuring and Viewing Threat Detection Statistics

Lesson 13: Configuring Site-to-Site VPNs Using Pre-Shared Keys

• Secure VPNs
• How IPsec Works
• Preparing to Configure an IPsec VPN
• Configuring a Site-to-Site VPN Using Pre-Shared Keys
• Modifying the Site-to-Site VPN Configuration
• Test and Verify VPN Configuration

Lesson 14: Configuring Security Appliance Remote-Access VPNs

• Introduction to Cisco Easy VPN
• Overview of Cisco VPN Client
• Configuring Remote-Access VPNs
• Configuring Users and Groups

Lesson 15: Configuring the Cisco ASA Security Appliance for SSL VPN

• SSL VPN Overview
• Using the SSL VPN Wizard to Configure Clientless SSL VPN
• Verifying Clientless SSL VPN Operations

Lesson 16: Configuring Transparent Firewall Mode

• Transparent Firewall Mode Overview
• Traversing a Security Appliance in Transparent Mode
• Configuring Transparent Firewall Mode
• Monitoring and Maintaining Transparent Firewall Mode

Lesson 17: Configuring Security Contexts

• Security Context Overview
• Enabling Multiple Context Mode
• Configuring Security Contexts
• Managing Security Contexts

Lesson 18: Configuring Failover

• Understanding Failover
• Configuring Redundant Interfaces
• Active/Standby LAN-Based Failover Configuration
• Active/Active Failover Configuration
• Remote Command Execution

Lesson 19: Managing the Security Appliance

• Managing System Access
• Configuring Command Authorization
• Managing Configurations
• Managing Images and Activation Keys

Course labs
Lab: Prepare to Use Cisco ASDM to Configure the Security Appliance
Lab: Configure the Security Appliance with Cisco ASDM
Lab: Configure Translations
Lab: Configure ACLs
Lab: Configure Object Groups
Lab: Configure AAA on the Security Appliance Using Cisco Secure ACS for Windows
Lab: Configure Advanced Protocol Inspection on the Security Appliance
Lab: Configure Threat Detection on the Security Appliance
Lab: Configure Security Appliance Site-to-Site VPN
Lab: Configure a Secure VPN Using IPsec Between a Security Appliance and a Cisco VPN Client
Lab: Configure the Security Appliance to Provide Secure Clientless SSL VPN Connectivity
Lab: Configure Security Appliance Transparent Firewall
Lab: Configure LAN-Based Active/Standby Failover
Lab: Configure LAN-Based Active/Active Failover
Lab: Manage the Security Appliance