Capstone: ASA Build

Step 1

Phase 1 — Foundation: hostname، passwords، اور management interface، بالکل asa-01 کی طرح۔Phase 1 — Foundation: hostname, passwords, aur management interface, bilkul asa-01 ki tarah.Phase 1 — Foundation: hostname, passwords, and the management interface, exactly as in asa-01.

hostname ASA-PROD
domain-name corp.local
enable password Cisc0En4ble
passwd Cisc0Login
interface management 0/0
nameif management
security-level 100
ip address 192.168.10.10 255.255.255.0
no shutdown
exit

Step 2

Phase 2 — Interfaces & routing: تینوں interfaces کو نام دیں، security levels set کریں، IPs assign کریں، اور default route add کریں۔Phase 2 — Interfaces & routing: teeno interfaces ko naam do, security levels set karo, IPs assign karo, aur default route add karo.Phase 2 — Interfaces & routing: name all three interfaces, set security levels, assign IPs, and add the default route.

interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/1
nameif outside
security-level 0
ip address 203.0.113.2 255.255.255.0
no shutdown
exit
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 172.16.1.1 255.255.255.0
no shutdown
exit
route outside 0.0.0.0 0.0.0.0 203.0.113.1 1

Step 3

Phase 3 — NAT: inside users کے لیے dynamic PAT، DMZ web server کو اس کے public IP سے map کرنے والا static NAT۔Phase 3 — NAT: inside users ke liye dynamic PAT, DMZ web server ko uske public IP se map karne wala static NAT.Phase 3 — NAT: dynamic PAT for inside users, static NAT mapping the DMZ web server to its public IP.

object network INSIDE_NET
subnet 10.1.1.0 255.255.255.0
nat (inside,outside) dynamic interface
exit
object network DMZ_WEB
host 172.16.1.10
nat (dmz,outside) static 203.0.113.10
exit

Step 4

Phase 4 — Access control: object groups plus ACLs تاکہ دنیا صرف DMZ web server تک 80/443 پر پہنچے، جبکہ inside users کو full outbound access ہو۔Phase 4 — Access control: object groups plus ACLs taake duniya sirf DMZ web server tak 80/443 par pahunche, jabke inside users ko full outbound access ho.Phase 4 — Access control: object groups plus ACLs so the world reaches only the DMZ web server on 80/443, while inside users have full outbound access.

object-group network DMZ_SERVERS
network-object host 172.16.1.10
exit
object-group service WEB_PORTS tcp
port-object eq www
port-object eq https
exit
access-list OUTSIDE_IN extended permit tcp any object-group DMZ_SERVERS object-group WEB_PORTS
access-group OUTSIDE_IN in interface outside
access-list INSIDE_OUT extended permit ip 10.1.1.0 255.255.255.0 any
access-group INSIDE_OUT in interface inside

Step 5

Phase 5 — AAA & management: local admin، SSH/HTTPS کے لیے AAA، RSA keys، اور SSH/ASDM کے لیے management-only access۔Phase 5 — AAA & management: local admin, SSH/HTTPS ke liye AAA, RSA keys, aur SSH/ASDM ke liye management-only access.Phase 5 — AAA & management: local admin, AAA for SSH/HTTPS, RSA keys, and management-only access for SSH and ASDM.

username fwadmin password FwAdm1n! privilege 15
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
crypto key generate rsa modulus 2048
ssh version 2
ssh 192.168.10.0 255.255.255.0 management
http server enable
http 192.168.10.0 255.255.255.0 management

🖱️ ASDM final review: Configuration > Firewall > Access Rules اور NAT Rules — full policy visually confirm کریں۔ASDM final review: Configuration > Firewall > Access Rules aur NAT Rules — full policy visually confirm karo.ASDM final review: Configuration > Firewall > Access Rules and NAT Rules — confirm the full policy visually.

Step 6

Phase 6 — Visibility: logging اور threat detection enable کریں تاکہ نیا firewall پہلے دن سے خود پر نظر رکھے۔Phase 6 — Visibility: logging aur threat detection enable karo taake naya firewall pehle din se khud par nazar rakhe.Phase 6 — Visibility: enable logging and threat detection so the new firewall watches itself from day one.

logging enable
logging timestamp
logging buffered warnings
threat-detection basic-threat
threat-detection scanning-threat

Step 7

Phase 7 — Validate: DMZ web flow اور inside outbound flow کو packet-trace کریں (دونوں ALLOW ہونے چاہیے)، پھر save کریں۔ Handover کے لیے final config document کریں۔Phase 7 — Validate: DMZ web flow aur inside outbound flow ko packet-trace karo (dono ALLOW hone chahiye), phir save karo. Handover ke liye final config document karo.Phase 7 — Validate: packet-trace the DMZ web flow and an inside outbound flow (both must ALLOW), then save. Document the final config for handover.

packet-tracer input outside tcp 203.0.113.50 40000 203.0.113.10 80 detailed
packet-tracer input inside tcp 10.1.1.50 40001 8.8.8.8 443 detailed
write memory