! Edward Johns — ASA lab configuration snapshot
! Sanitised for portfolio publication.
! Credentials and checksum removed; duplicate terminal export omitted.
! Upstream gateway replaced with documentation address 192.0.2.1.
! Private lab addresses retained to explain topology.
! Reference only: not a deployable configuration or a validated security baseline.
: Saved
:
ASA Version 8.4(2)
!
hostname ASA-1
domain-name lab.local
! Credential line removed for publication.
! Credential line removed for publication.
names
!
interface GigabitEthernet0
 nameif outside
 security-level 0
 ip address dhcp
!
interface GigabitEthernet1
 nameif inside
 security-level 100
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet2
 nameif dmz
 security-level 50
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet3
 nameif inside30
 security-level 90
 ip address 10.30.0.1 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
 domain-name lab.local
object network MGMT-NET
 subnet 192.168.10.0 255.255.255.0
object network DMZ-NET
 subnet 192.168.20.0 255.255.255.0
object network INSIDE30-NET
 subnet 10.30.0.0 255.255.255.0
access-list OUTSIDE-IN extended permit icmp any any
access-list INSIDE-OUT extended permit ip any any
access-list DMZ-IN extended permit tcp 192.168.20.0 255.255.255.0 host 192.168.10.12 eq 1514
access-list DMZ-IN extended permit tcp 192.168.20.0 255.255.255.0 host 192.168.10.12 eq 1515
access-list DMZ-IN extended deny tcp any host 192.168.10.12 eq https
access-list INSIDE-IN extended permit tcp 192.168.10.0 255.255.255.0 host 192.168.10.12 eq https
access-list INSIDE30-IN extended permit tcp 10.30.0.0 255.255.255.0 host 192.168.10.12 eq 1514
access-list INSIDE30-IN extended permit tcp 10.30.0.0 255.255.255.0 host 192.168.10.12 eq 1515
access-list INSIDE30-IN extended permit tcp 10.30.0.0 255.255.255.0 host 192.168.10.12 eq https
pager lines 24
logging enable
logging timestamp
logging trap informational
logging device-id hostname
logging host inside 192.168.10.12
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu inside30 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network MGMT-NET
 nat (inside,outside) dynamic interface
object network DMZ-NET
 nat (dmz,outside) dynamic interface
object network INSIDE30-NET
 nat (inside30,outside) dynamic interface
access-group INSIDE-OUT in interface inside
access-group DMZ-IN in interface dmz
access-group INSIDE30-IN in interface inside30
route outside 0.0.0.0 0.0.0.0 192.0.2.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ca trustpoint _SmartCallHome_ServerCA
 crl configure
telnet timeout 5
ssh 192.168.10.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
management-access inside
dhcpd dns 8.8.8.8
!
dhcpd address 192.168.10.50-192.168.10.150 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
!
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
: end