cisco asa firewall basics, security levels and nat

the hook

if you've ever inherited a cisco asa config from someone who left the company years ago, you know the feeling. a bunch of interfaces with weird names, no comments, and you're just praying nobody breaks anything. asa firewalls look intimidating but the whole thing runs on one simple idea: security levels. once that clicks, the rest of the config actually makes sense.

the three things every interface needs

every physical or logical interface on an asa needs three pieces of config before it does anything useful: a nameif, a security-level, and an ip address. skip one and the interface just sits there half configured, which honestly is a good failure mode. an asa that isn't fully set up won't accidentally pass traffic.

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 203.0.113.5 255.255.255.248

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0

nameif is just the friendly label, "outside" or "inside" or "dmz", whatever makes sense for that segment. the ip address is self explanatory. the security-level is the part that actually does work, and it's the piece most people gloss over.

security levels are the real access control

outside defaults to 0. inside defaults to 100. anything in between, like a dmz, usually lands somewhere around 50. the rule the asa enforces automatically, before you write a single access-list, is this: traffic from a higher security level to a lower one is allowed by default, traffic from a lower level to a higher one is blocked by default.

so your inside network can reach the internet without any extra rules, but nothing from the outside can reach inside unless you explicitly permit it. that's your baseline defense right there, built into the platform, not bolted on. if you're auditing an asa you inherited, the first thing to check is whether someone weakened this baseline with an access-list that punches holes from low to high without a real reason. that's usually where the exposure lives.

show run interface
show nameif

run those and map out every interface's security-level. if you find two interfaces set to the same level, traffic between them is blocked both directions by default too, which is fine for isolating two internal segments but confusing if you didn't mean to do that.

nat and why pat matters for defense

your internal 192.168.x.x addresses can't route on the public internet, so the asa translates them using a network object with dynamic nat pointed at the outside interface. this is your pat, port address translation, everyone sharing the one public ip on the outside interface.

object network inside-net
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

from a defensive standpoint this matters for two reasons. first, it hides your internal addressing scheme from anyone scanning your public ip, they see one address, not your whole subnet layout. second, and more importantly, nat is not a firewall rule. people sometimes assume that because internal ips aren't reachable directly, they're "safe." they're not. always check your access-lists on the outside interface separately, don't rely on nat as your security boundary.

the default route, and why it's a common blind spot

without a default route the asa has no idea where to send traffic destined for the internet.

route outside 0.0.0.0 0.0.0.0 203.0.113.1

that last ip is your isp's gateway. simple, but worth checking during an audit because a misconfigured or duplicate default route can cause asymmetric routing, and asymmetric routing on a stateful firewall means dropped connections or, worse, traffic taking a path that skips inspection entirely.

the takeaway

the security-level number is doing almost all the real work here. nameif is just a label, the ip address is plumbing, but security-level is the actual gatekeeper deciding what's allowed to talk to what by default. if you're defending your own network, start every asa review the same way: list every interface, list every security-level, and ask yourself why any access-list exists that lets traffic flow from low to high. if you can't answer that question clearly, that rule is your exposure. fix the reasoning, not just the rule.