Cisco Asa

---
name: cisco-asa
description: "Expert coverage of Cisco ASA (Adaptive Security Appliance): security levels, ACLs, MPF, multiple context mode, failover HA, clustering, VPN (site-to-site and AnyConnect/Secure Client), NAT, and ASDM. Use for \"Cisco ASA\", \"ASA firewall\", \"security level\", \"ASDM\", \"ASA context\", \"ASA failover\", \"ASA VPN\", \"MPF\", \"ASA NAT\", \"crypto map\", \"tunnel-group\", \"WebVPN\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `firewall` skill."
license: MIT
---

# Cisco ASA

This skill covers Cisco ASA (Adaptive Security Appliance) running ASA 9.x software. ASA runs the LINA engine exclusively -- the same code that serves as the L2-L4 engine inside FTD. ASA does not include Snort; it relies on ACLs, stateful inspection, and MPF for security enforcement.

**ASA 9.x status (2024-2026):** Sustaining engineering mode. No new features. Security vulnerability patches and critical bug fixes only. All new Cisco firewall features are FTD-exclusive.

Areas of expertise include:

- Security levels and implicit traffic rules
- Extended ACLs and object groups
- Modular Policy Framework (MPF): class-map, policy-map, service-policy
- Multiple security contexts (virtual firewalls)
- Active/Standby and Active/Active failover
- Clustering on Firepower 4100/9300
- VPN: Site-to-site IKEv2, AnyConnect/Secure Client (SSL/DTLS/IKEv2), WebVPN
- NAT (Auto-NAT, Twice-NAT, Section 1/2/3)
- DAP (Dynamic Access Policies) for VPN
- ASDM and CDO management

## When ASA is the Right Choice vs. FTD

### Use ASA When

| Requirement | Reason |
|---|---|
| Multi-context (virtual firewalls) | FTD does not support security contexts |
| Legacy hardware (ASA 5500-X) | Cannot run FTD 7.1+ |
| Complex multi-tenant | ASA contexts provide full per-tenant isolation |
| VPN-only use case | ASA CLI is simpler for VPN concentrator deployments |
| Clientless WebVPN | Not supported on FTD; ASA-only feature |
| Regulatory/change freeze | Stable environment where FTD migration adds risk |
| VPN load balancing | Not supported on FTD |

### Use FTD Instead When
IPS, application visibility, URL filtering, SSL decryption, malware inspection, user-identity policy, zero trust, or any NGFW feature is needed. All new Cisco hardware runs FTD.

## How to Approach Tasks

1. **Classify**: VPN troubleshooting, ACL design, context configuration, failover, or migration planning
2. **Determine context**: Single or multi-context mode? Routed or transparent?
3. **Identify version**: ASA 9.20, 9.22, 9.24 -- mostly maintenance differences
4. **Load context** from `references/architecture.md` for deep knowledge
5. **Analyze** using ASA-specific reasoning
6. **Recommend** with CLI examples

## Security Levels

Interfaces are assigned levels 0-100:
- **100 (inside)**: Highest trust; traffic to lower levels permitted by default
- **0 (outside)**: Lowest trust; traffic to higher levels denied unless permitted by ACL
- **50 (DMZ)**: Mid-level; requires ACLs for traffic in both directions
- Same-level traffic denied unless `same-security-traffic permit inter-interface`
- Explicit ACLs override security-level defaults

## Modular Policy Framework (MPF)

Three components for traffic processing:

**1. Class-Map** (traffic classifier):
```
class-map MATCH_HTTP
  match port tcp eq 80
```

**2. Policy-Map** (actions):
```
policy-map GLOBAL_POLICY
  class MATCH_HTTP
    inspect http
  class inspection_default
    inspect dns
    inspect ftp
    inspect sip
```

**3. Service-Policy** (bind to interface/global):
```
service-policy GLOBAL_POLICY global
```

Default inspection traffic (globally enabled): DNS, FTP, H.323, HTTP, ICMP, MGCP, PPTP, RSH, RTSP, SIP, Skinny, SNMP, SQLnet, SUNRPC, TFTP, XDMCP.

## Multiple Context Mode

Partitions ASA into independent virtual firewalls:
- Each context: own interfaces, ACLs, NAT, routing, firewall rules
- System context (admin): manages physical chassis
- Supports routed and transparent mode per context
- **FTD does not support contexts** -- this is the primary reason to retain ASA
- Context limits: up to 250 on ASA 5585-X

## Failover HA

### Active/Standby
- Active owns IP/MAC; standby synchronized and idle
- Stateful failover: connections, NAT xlate, ARP, VPN tunnels, routing replicated
- VPN sessions survive failover without user reconnection
- Dedicated failover link (recommended: 100Mbps minimum)
- Supported in routed, transparent, single-context, and multi-context

### Active/Active
- **Requires multi-context mode**
- Contexts divided into two failover groups
- Group 1 active on ASA-1; Group 2 active on ASA-2
- VPN only supported on admin context in active/active (significant limitation)

## NAT

Same architecture as FTD (both use LINA):

**Section 1 (Manual NAT, pre-auto)**: First match wins. Complex scenarios.
**Section 2 (Auto-NAT)**: Object-based, auto-ordered by specificity.
**Section 3 (Manual NAT, `after-auto`)**: Catch-all.

**Identity NAT for VPN:**
```
nat (inside,outside) source static INSIDE INSIDE destination static VPN_POOL VPN_POOL no-proxy-arp route-lookup
```

## VPN

### Site-to-Site IKEv2
```
crypto ikev2 policy 10
  encryption aes-256
  integrity sha256
  group 14
  prf sha256
  lifetime seconds 86400

crypto ikev2 enable outside

tunnel-group 203.0.113.2 type ipsec-l2l
tunnel-group 203.0.113.2 ipsec-attributes
  ikev2 remote-authentication pre-shared-key SECRET
  ikev2 local-authentication pre-shared-key SECRET
```

### AnyConnect / Secure Client Remote Access
- SSL/TLS (TCP 443) + DTLS (UDP 443) preferred
- IKEv2 option for better performance
- DTLS recommended: avoids TCP-over-TCP retransmission issues
- Group policies define per-tunnel settings
- Tunnel groups define authentication method

### DAP (Dynamic Access Policies)
Dynamically adjusts access based on endpoint posture and group membership:
- Evaluated at VPN session establishment
- Aggregates AAA attributes + endpoint posture
- Can assign ACLs, group policies, bookmarks, or terminate connections
- More granular than static group policy assignment

### WebVPN (Clientless)
- Browser-based VPN without client software
- Portal for web apps, RDP, Citrix
- **ASA-only** -- not supported on FTD
- FTD replacement approach: Clientless ZTAA (7.4+)

## Common Pitfalls

1. **Security level misconceptions**: Security levels only control default traffic flow. Explicit ACLs override them. Don't rely on security levels alone for security.

2. **MPF inspection and NAT interaction**: MPF inspect actions (especially SIP, FTP) can interact unexpectedly with NAT. Disable unnecessary ALGs if causing problems.

3. **Context resource sharing**: In multi-context mode, all contexts share the same physical hardware. One context's high utilization can affect others.

4. **Active/Active VPN limitation**: VPN is only supported on the admin context in active/active mode. This severely limits VPN scalability in active/active.

5. **ASDM Java issues**: ASDM requires Java, which is increasingly problematic on modern OS. Use CLI or CDO for management.

6. **Sustaining mode**: ASA 9.x receives no new features. Plan FTD migration for environments needing NGFW capabilities.

7. **Distributed S2S VPN (9.20+)**: Distributed VPN in clustering mode only works for IKEv2 site-to-site. AnyConnect/remote access VPN remains centralized to the control node.

## ASA to FTD Migration

Use the **Firepower Migration Tool (FMT)**:
1. Export `show running-config` from ASA
2. Load into FMT; generates pre-migration report
3. FMT converts: objects, ACLs, NAT, interfaces, static routes automatically
4. Manual work: VPN, dynamic routing, HA, clientless WebVPN, security contexts, complex MPF
5. Each ASA context becomes a separate FTD device
6. VPN load balancing has no FTD equivalent

## Reference Files

- `references/architecture.md` -- Security levels, operating modes, contexts, failover, clustering, MPF, ASA 9.x versions, ASA vs FTD comparison. Read for architectural and migration questions.