Cisco (asa) adaptive security appliance

All you need to know about Cisco (ASA) Adaptive Security Appliance:

A security device that integrates firewall, antivirus, virtual private network (VPN), and intrusion prevention features is called a Cisco ASA (Cisco Adaptive Security Appliance).

The Use of Packet Filtering by an ASA:

• Packet filtering permits legitimate external users to create incoming requests to your web servers. An ASA protects internal networks by allowing valid packets into the demilitarized zone — and solely there.
• Think of a user online named Ally. Ally needs to access one of your web servers. However, the web server is behind your ASA in the DMZ. By default, the web server won’t be able to receive that traffic. However, that could be your company’s website or sales catalog. It cannot be prevented from accessing the internet. Thankfully, there’s packet filtering.
• Once packet filtering functionality is engaged, access lists get applied to the ASA’s internet-facing interface. An access list instructs the ASA on what traffic is permissible. Once applied, you’re essentially telling the ASA, “Please allow traffic through if it’s internet traffic destined for a specific IP address associated with one of your web servers, but only let it move to that address, and only let those packets through.”
• With packet filtering established on an ASA, internet users making valid requests can access public web servers. At the same time, we’re never allowing external users from the outside into our internal zone. That’s because everything we know about zone views is maintained when dealing with packet filtering.

Do ASAs have the ability to translate network or port addresses?

An ASA can provide network address translation (NAT) or port address translation (PAT), so that all the devices sitting behind it appear to themselves to be on the 10.0.0.0 network. However, requests to the internet get global routing addresses, and they are swapped out when they return to the network.

If you were to check your IP address right now on your computer (try “ipconfig” on Windows or “ifconfig” on Linux or Mac), it’s very likely your device is on a 10.x.x.x address or a 192.168.x.x address. That’s because those addresses are in the RFC 1918 address base. They’re private and not allowed on the internet. Service providers block these private addresses. However, your devices believe that’s where they can locate themselves on your network. This is due to another feature that ASAs provide: NAT/PAT. Network Address Translation (NAT) and Port Address Translation (PAT) essentially “lie” about source IP addresses. The firewall itself could have a globally routable address like 23.1.2.3, but the devices behind the ASA don’t have one. As traffic passes through the ASA, it uses NAT or PAT to translate the source addresses into the ASA’s address — essentially “lying” about where the request is coming from. NAT and PAT make it so that those packets traverse the internet with the ASA’s return address. Then, once a reply comes back, the ASA swaps out the destination with the internal address of the device that made the request in the first place.

The Next Upgrade Technology for Cisco ASA is CCIE Security v6.1. It is the highest-level certification offered by Cisco Systems.