In this step, hosts from the outside network can only use SSH to communicate with the ASA.

R3 represents an ISP that connects an administrator from a network management company, who has been hired to remotely manage your network.

The ASA is an edge CPE security device that connects the internal corporate network and DMZ to the ISP while providing NAT and DHCP services to inside hosts.

The ASA will be configured for management by an administrator on the internal network and by the remote administrator.

Layer 3 VLAN interfaces provide access to the three areas created in the activity: Inside, Outside, and DMZ.

The ISP assigned the public IP address space of 209.165.200.22429, which will be used for address translation on the ASA.

This activity provides additional practice and simulates most of the ASA 5505 configurations.

When compared to a real ASA 5505, there may be slight differences in command output or commands that are not yet supported in Packet Tracer.

This is to ensure that you do not inadvertently change some ASA default values.

For example, the default name of the inside interface is inside and should not be changed.

Click Check Results to see which assessment items are already scored as correct.

However, all routers, PCs, and the DMZ server are configured.

In addition, the process of moving between configuration modes and submodes is essentially the same.

The VLAN 3 (dmz) interface will be configured in Part 5 of the activity.

If any of the physical or logical interfaces previously configured are not upup, troubleshoot as necessary before continuing.

These appear in two different places in the running configuration.

Display the NAT object configuration using the show run command.

The outgoing pings (echos) were translated and sent to the destination.

The returning echo replies were blocked by the firewall policy.

You will configure the default inspection policy to allow ICMP in Step 3 of this part of the activity.

As a modification, we can create the default policy map that will perform the inspection on inside-to-outside traffic.

When configured correctly only traffic initiated from the inside is allowed back in to the outside interface.

Add the inspection of ICMP traffic to the policy map list using the following commands.

9.3.2.1 Packet Tracer