Cisco ASA CLI practice lab
This is a browser ASA 9.18 style CLI. It is not an ASAv and it does not change a real firewall. You start in user mode with the > prompt. enable moves you to privileged #, and configure terminal opens (config)#. Interface, object network, and object service each open their own sub-mode, the same way ASA does.
The commands this page is built around are enable, configure terminal, nameif, security-level, show xlate, and packet-tracer. Use the side list for the exact lines. Read nameif and security-level before you write an ACL in your head: ASA still decides interface trust from the security level unless you have changed that habit on purpose.
Guest mode loads a dummy ASA config. No licence and no VM. Packet-tracer here explains the practice path through that dummy config. It does not test a live appliance. If a command is not printed in the side panel, this shell will not answer it. After you build a practice translation, show xlate is how you see the table, not only the object you typed. Sign-in is optional.
Common questions
How do I get to config mode?
enable, then configure terminal. The prompt should show (config)#.
What does this lab show for translations?
show xlate against the dummy config, plus packet-tracer for a practice flow.
Is nameif required on an interface?
In this lab, yes, follow the side-panel example. An ASA interface needs a nameif and a security-level before policy makes sense.
Does packet-tracer hit a real firewall?
No. It runs against the practice config in the browser.
Cisco ASA CLI
ASA 9.18
⚠ unsaved