Cisco ASA Command Reference

anyconnect enable

Enables AnyConnect VPN access on the ASA for a specific group policy or tunnel group.

WebVPN Config

anyconnect image disk0:/[filename]

Specifies the AnyConnect client image file to be used for SSL VPN connections on the Cisco ASA.

WebVPN Config

authentication pre-share

Configures pre-shared key authentication for IKEv1 policies on Cisco ASA Firewall.

IKEv1 Policy Config

crypto ikev1 enable [intf]

Enables IKEv1 (ISAKMP) on a specified interface for IPsec VPN negotiations.

Global Config

crypto ikev1 policy [priority]

Configures an IKEv1 policy with a specified priority for IPsec VPN negotiations on Cisco ASA Firewall.

Global Config

crypto map [name] [seq] match address [acl]

Associates an access list with a crypto map entry to define which traffic should be encrypted for an IPsec VPN tunnel.

Global Config

crypto map [name] interface [intf]

Applies a crypto map to an interface to enable IPsec VPN policy on that interface.

Global Config

encryption aes-256

Specifies the AES-256 encryption algorithm for IKEv1 policy to secure VPN tunnels.

IKEv1 Policy Config

ip local pool [name] [start]-[end]

Creates a local pool of IP addresses for VPN remote access clients to be assigned dynamically.

Global Config

pre-shared-key [key]

Sets the pre-shared key for IKE authentication in an IPsec tunnel group on a Cisco ASA firewall.

Tunnel Group IPsec Config

show crypto ipsec sa

Displays the current IPsec security association (SA) database, showing active tunnels and their parameters.

Privileged EXEC

show crypto isakmp sa

Displays the current Internet Key Exchange (IKE) Phase 1 security associations (SAs) on the Cisco ASA Firewall, showing the status of ISAKMP negotiations.

Privileged EXEC

show vpn-sessiondb

Displays detailed information about active VPN sessions on the Cisco ASA Firewall.

Privileged EXEC

tunnel-group [peer-ip] type ipsec-l2l

Creates or modifies a tunnel group for IPsec LAN-to-LAN VPN connections on Cisco ASA.

Global Config

webvpn enable [intf]

Enters WebVPN configuration mode and optionally enables WebVPN on a specific interface.

Global Config

clear xlate

Clears all or specified dynamic xlate (translation) entries from the ASA translation table, forcing new translations to be created for subsequent traffic.

Privileged EXEC

nat (inside,outside) dynamic interface

Configures dynamic NAT to translate inside private IP addresses to the outside interface's IP address using Port Address Translation (PAT).

Object Config

nat (inside,outside) dynamic interface

Configures dynamic NAT to translate inside source addresses to the outside interface IP address.

Global Config

nat (inside,outside) static [real-ip] [mapped-ip]

Configures static NAT to translate a real IP address to a mapped IP address for traffic between inside and outside interfaces.

Global Config

object network [name]

Defines or modifies a network object for use in NAT, ACLs, or other policies on Cisco ASA.

Global Config

show nat

Displays the current Network Address Translation (NAT) configuration on the Cisco ASA Firewall.

Privileged EXEC

show nat pool

Displays the current NAT pool configuration, including pool name, IP address range, and usage statistics.

Privileged EXEC

show xlate

Displays active Network Address Translation (NAT) translations in the ASA firewall, showing the mapping between real and mapped addresses.

Privileged EXEC

subnet [ip] [mask]

Defines a subnet object for use in NAT rules on Cisco ASA Firewall.

Object Config

access-group [name] in interface [intf]

Applies an access control list (ACL) to a specific interface for filtering inbound traffic.

Global Config

access-list [name] extended deny [proto] [src] [dst] log

Creates or modifies an extended access control list (ACL) entry that denies traffic matching specified protocol, source, and destination, with logging enabled.

Global Config

access-list [name] extended permit [proto] [src] [dst]

Creates an extended access control list (ACL) entry to permit traffic based on protocol, source, and destination.

Global Config

show access-group

Displays the access-group configuration applied to interfaces, showing which access lists are attached and in which direction.

Privileged EXEC

show access-list

Displays the current access control lists (ACLs) configured on the Cisco ASA firewall, including hit counts and packet matches.

Privileged EXEC

show conn

Displays the current state of all active connections through the ASA firewall, including protocol, source/destination IPs, ports, and connection flags.

Privileged EXEC

show conn count

Displays the total number of connections currently tracked by the ASA firewall.

Privileged EXEC

ip address [ip] [mask]

Assigns an IP address and subnet mask to an interface on a Cisco ASA firewall.

Interface Config

nameif [name]

Assigns a name to an interface for identification and security policy referencing.

Interface Config

no shutdown

Enables an interface on a Cisco ASA Firewall, bringing it out of administrative shutdown state.

Interface Config

security-level [0-100]

Sets the security level for an interface, determining traffic flow permissions between interfaces.

Interface Config

show interface

Displays detailed status and statistics for all or specified interfaces on the Cisco ASA Firewall.

Privileged EXEC

show interface ip brief

Displays a summary of all interfaces with their IP address and status, useful for quickly verifying interface configuration and connectivity.

Privileged EXEC

network [ip] [wildcard] area [id]

Configures an OSPF network statement to enable OSPF on interfaces matching the specified IP address and wildcard mask, and assigns them to a specific OSPF area.

OSPF Config

passive-interface [intf]

Configures an OSPF interface as passive, preventing OSPF hello packets from being sent and received on that interface while still advertising its connected subnet.

OSPF Config

route [intf] [network] [mask] [gateway]

Configures a static route on the Cisco ASA Firewall to define the next-hop gateway for a destination network.

Global Config

router ospf [pid]

Enables OSPF routing process configuration on the Cisco ASA Firewall.

Global Config

show ospf neighbor

Displays the OSPF neighbor table, showing all OSPF neighbors and their adjacency states.

Privileged EXEC

show route

Displays the current IP routing table on the Cisco ASA Firewall, showing known routes and their metrics.

Privileged EXEC

failover

Enables and configures failover redundancy between two ASA firewalls for high availability.

Global Config

failover lan interface [name] [intf]

Configures the LAN interface used for failover communication between two ASA firewalls in a failover pair.

Global Config

failover lan unit [primary|secondary]

Designates the local unit as the primary or secondary unit in an active/standby failover pair.

Global Config

failover link [name] [intf]

Configures the dedicated failover link interface for stateful failover communication between two ASA units.

Global Config

show failover

Displays the current failover status and configuration of the ASA firewall pair.

Privileged EXEC

show failover state

Displays the current failover state and status of the ASA firewall in a failover pair.

Privileged EXEC

aaa authentication ssh console LOCAL

Configures the ASA to use the local database for SSH authentication.

Global Config

enable password [password]

Sets the password required to enter privileged EXEC mode from user EXEC mode.

Global Config

http [source] [mask] [intf]

Configures HTTP access to the ASA for management via ASDM or browser, restricting access to specific source IPs or subnets on a given interface.

Global Config

http server enable

Enables the HTTP server on the Cisco ASA to allow HTTPS access for ASDM management.

Global Config

ssh [source] [mask] [intf]

Restricts SSH access to the ASA by specifying allowed source IP addresses or subnets on a given interface.

Global Config

username [name] password [pw] privilege [15]

Creates a local user account with a specified password and privilege level for authentication and authorization on the Cisco ASA Firewall.

Global Config

capture [name] interface [intf] match ip any any

Captures packets on a specified interface matching any IP traffic for troubleshooting and analysis.

Privileged EXEC

debug icmp trace

Enables real-time debugging of ICMP packets traversing the Cisco ASA Firewall to troubleshoot connectivity issues.

Privileged EXEC

logging buffered informational

Configures the logging buffer to capture messages at the informational severity level and above for local viewing.

Global Config

logging on

Enables logging on the Cisco ASA Firewall to capture system messages and debug output.

Global Config

packet-tracer input [intf] tcp [src] [sport] [dst] [dport]

Simulates a packet traversing the firewall to verify ACL, NAT, and routing policies.

Privileged EXEC

ping [ip]

Tests basic network connectivity from the ASA to a remote host using ICMP echo requests.

Privileged EXEC

show capture [name]

Displays the contents of a packet capture buffer on the Cisco ASA firewall for traffic analysis and troubleshooting.

Privileged EXEC

traceroute [ip]

Traces the route packets take from the Cisco ASA to a destination IP address, helping diagnose network path issues.

Privileged EXEC

show running-config

Displays the current running configuration of the Cisco ASA Firewall.

Privileged EXEC

show version

Displays the system software version, hardware configuration, license information, and uptime of the Cisco ASA firewall.

Privileged EXEC

write erase

Erases the startup configuration and resets the ASA to factory defaults.

Privileged EXEC

write memory

Saves the running configuration to the startup configuration in nonvolatile memory.

Privileged EXEC