Build a Secure Network with Firewall

Configure a Cisco ASA firewall with DMZ, NAT, and ACLs in Packet Tracer.

Introduction

30 Second Summary

Every organization needs layers of security to protect its network. Think of it like a building with a public lobby, a semi-restricted office floor, and a locked server room. Each layer controls who can access what.

In this project, you will build a simulated enterprise network with three security zones, configure a firewall to control traffic between them, and verify that your security policies work by testing allowed and blocked connections.

What You'll Build

A three-zone network in Cisco Packet Tracer protected by a Cisco ASA 5505 firewall, with NAT rules and ACLs enforcing least-privilege access between an Inside zone, a DMZ, and an Outside zone.

By the end of this project, you'll have:

  • A working multi-zone network topology with a configured Cisco ASA firewall separating Inside, DMZ, and Outside zones.
  • Tested and verified firewall rules (ACLs) that control exactly which traffic flows between zones.
  • Hands-on experience with NAT, security levels, and Simulation Mode to prove your policies work.
  • Secret Mission: Map your security controls to the NIST Cybersecurity Framework and create a compliance document.

Are there any prerequisites?

You should have a basic understanding of IP addressing (what an IP address and subnet mask are). No prior firewall or Cisco experience is needed.

Set Up Cisco Packet Tracer

Before you can build a secure network, you need the right simulation tool. Cisco Packet Tracer is a free network simulation application that lets you design, configure, and test network topologies without physical hardware.

In this step, you will create a free Cisco SkillsForAll account, install Packet Tracer on your Windows PC, and get familiar with the workspace where you will build your firewall lab.

In this step, get ready to:
  • Create a SkillsForAll account and download Cisco Packet Tracer.
  • Install Packet Tracer and sign in.
  • Explore the workspace and locate key device categories.
Create a SkillsForAll account and download Packet Tracer

Cisco Packet Tracer requires a free SkillsForAll account to download and use. You will create your account, enroll in a short course that unlocks the download, and then grab the installer.

  • Open your web browser and navigate to https://skillsforall.com.
  • Click Sign Up and create a free account using your email address.
  • Once signed in, search for the Getting Started with Cisco Packet Tracer course.
  • Click Enroll on the course page.
  • After enrolling, navigate to the course resources to find the Packet Tracer download link.

Which version should I download?

Packet Tracer comes in 32-bit and 64-bit versions. If you are running Windows 8.1 or Windows 10, download the 32-bit version. It only requires 2GB of free RAM, which is ideal for a 4GB system.

If you are running Windows 11, download the 64-bit version instead. The 32-bit installer is not compatible with Windows 11. Close other applications before launching to free up RAM.

  • Download the Packet Tracer installer for your Windows version (32-bit for Windows 8.1/10, 64-bit for Windows 11).

Don't see the download link?

Make sure you are enrolled in the Getting Started with Cisco Packet Tracer course. The download is only available after enrollment. If the page does not show a download option, try refreshing or navigating to the course resources section.

Help me find the Packet Tracer download on SkillsForAll.

Install and verify Packet Tracer

With the installer downloaded, you will now install the application and sign in so Packet Tracer can authenticate your SkillsForAll account.

  • Double-click the downloaded installer file to launch it.
  • Accept the license agreement when prompted.
  • Choose the default installation location and click Install.
  • Wait for the installation to complete, then click Finish.

What about the Windows Security Alert?

You may see a Windows Security Alert asking whether to allow Packet Tracer network access. Some advanced features like multi-user mode require network access. For this project, you can safely allow or deny network access. The firewall lab works entirely offline.

  • Press the Windows key to open your search bar.
  • Type Cisco Packet Tracer and press Enter to launch the application.
  • When the login window appears, leave the Login Server dropdown set to Worldwide (the default).
  • Click the Cisco Skills For All icon to start the login process.
  • Your web browser will open. Sign in with your SkillsForAll credentials if prompted.
  • Once you see the message "You have successfully logged in to Cisco Packet Tracer" in your browser, close the browser tab and return to Packet Tracer.

You should now see a blank workspace with a white canvas area and device category icons along the bottom of the screen.

Packet Tracer won't open or crashes?

If Packet Tracer fails to launch, check that your system meets the minimum requirements: 2GB of free RAM for the 32-bit version, or 4GB for 64-bit. Close other applications to free up memory and try again.

If the login fails or the browser never shows a success message, make sure you are signed into SkillsForAll in that same browser. Try clearing your browser cookies and logging in again.

Help me troubleshoot my Packet Tracer installation or login issues.

Familiarize yourself with the interface

Before building the network, take a moment to learn where key tools live in the Packet Tracer workspace. The bottom panel is where you will find every device you need for this project.

  • Look at the bottom-left of the workspace. You will see a row of device category icons.
  • Hover over each icon to see the category names: Network Devices (which includes Routers, Switches, Hubs, Wireless Devices, and Security), End Devices (PCs, servers), Components, and Connections.
  • Click the Network Devices icon, then click the Security subcategory.
  • Find the ASA 5505 in the specific devices panel that appears. This is the firewall you will configure in later steps.
  • Drag the ASA 5505 onto the white workspace canvas to place it.
  • Right-click the device and select Delete to remove it. You have confirmed you can place and delete devices.
  • Place another ASA 5505 on the workspace, then click on it to open its properties window.
  • Click the CLI tab at the top of the device properties window. This is the command-line interface where you will configure the firewall later.
  • Close the device properties window and delete the device from the workspace.

What is the CLI tab?

The CLI (Command Line Interface) tab gives you direct terminal access to configure a device using text commands. In later steps, you will type firewall configuration commands into this tab on the ASA 5505.

You now have a clean workspace and know where to find device categories, security devices, and the CLI tab.

Your simulation environment is ready. Next up, you will place all the devices for your three-zone network and assign IP addresses to build the topology.

Design the Network Topology

Your Packet Tracer environment is set up and ready to go. Now it's time to build the physical network that your firewall will protect.

Every enterprise network separates traffic into security zones. In this step, you will place all the devices, cable them together, and assign IP addresses so each zone has its own dedicated subnet.

In this step, get ready to:
  • Place the ASA firewall, switches, PCs, and server onto the workspace.
  • Cable all devices together using straight-through Ethernet cables.
  • Configure IP addresses on every end device and enable the web server.
Place devices and plan the IP scheme

A three-zone architecture needs a central firewall with separate networks on each side. You will place the ASA 5505 in the middle, with switches for the Inside and DMZ zones, and end devices representing employees, a web server, and an external attacker.

  • In the device categories at the bottom of the workspace, click the Security category (top row of icons).
  • Find ASA 5505 in the device list and drag it onto the center of the workspace.
  • Click the Switches category in the top row.
  • Drag a 2960 switch to the left of the ASA. This is your Inside switch.
  • Drag a second 2960 switch below the ASA. This is your DMZ switch.
  • Click the End Devices category in the top row.
  • Drag two PCs to the left of the Inside switch. These represent employee workstations (PC0 and PC1).
  • Drag one Server below the DMZ switch. This is your public-facing web server.
  • Drag one PC to the right of the ASA. This is the Outside PC simulating an internet user.

What is the IP addressing scheme?

Each zone gets its own subnet so the firewall can apply different rules to each. Here is the plan you will use throughout this project:

  • Inside zone: 192.168.1.0/24 (PC0: .10, PC1: .11, ASA inside interface: .1).
  • DMZ zone: 172.16.1.0/24 (Web server: .10, ASA DMZ interface: .1).
  • Outside zone: 203.0.113.0/24 (Outside PC: .20, ASA outside interface: .1).

The 203.0.113.0/24 range is a documentation-reserved block (RFC 5737), which makes it safe for lab environments without conflicting with real internet addresses.

Why three zones instead of two?

A simple inside/outside split forces you to choose: either the web server sits inside (exposing your whole network if it gets compromised) or outside (giving it zero firewall protection). A DMZ solves this by creating a middle zone where public services live. If an attacker compromises the web server, the firewall still blocks them from reaching employee workstations.

This network segmentation pattern is tested on both CompTIA Network+ and Security+ exams.

Cable the devices

With all devices placed, you need to physically connect them using Ethernet cables. In Packet Tracer, you select a cable type and then click each device to choose the specific port.

  • Click the Connections category at the bottom of the workspace (the lightning bolt icon).
  • Select Copper Straight-Through from the cable types that appear.
  • Click the Inside switch, then select FastEthernet0/1 from the popup menu.
  • Click the ASA 5505, then select Ethernet 0/1 from the popup menu. The cable connects the Inside switch to the ASA.
  • Select another Copper Straight-Through cable.
  • Click the DMZ switch, then select FastEthernet0/1.
  • Click the ASA 5505, then select Ethernet 0/2. This connects the DMZ switch to the ASA.
  • Select another Copper Straight-Through cable.
  • Click the Outside PC, then select FastEthernet0.
  • Click the ASA 5505, then select Ethernet 0/0. This connects the Outside PC directly to the ASA.
  • Connect PC0 to the Inside switch: click PC0, select FastEthernet0, then click the Inside switch and select an available FastEthernet port.
  • Connect PC1 to the Inside switch using the same process. Select FastEthernet0 on PC1 and a different FastEthernet port on the switch.
  • Connect the Web Server to the DMZ switch: click the server, select FastEthernet0, then click the DMZ switch and select an available FastEthernet port.

After connecting each cable, you will see link lights appear. Green or amber lights mean the connection is active.

  • Enable port labels so you can verify your connections. Click Options in the top menu bar.
  • Click Preferences.
  • Check the box for Always Show Port Labels, then close the preferences window.

You should now see interface labels on every cable. Confirm that the ASA shows Ethernet 0/0 connected to the Outside PC, Ethernet 0/1 connected to the Inside switch, and Ethernet 0/2 connected to the DMZ switch.

Don't see port labels on your cables?

Make sure you checked Always Show Port Labels under Options > Preferences. If cables show red X marks instead of green or amber lights, the connection failed. Delete the cable (click it, press Delete) and re-create it, making sure you select the correct port on each side.

help me fix my cable connections in Packet Tracer

Configure end device IP addresses

Each device needs an IP address, subnet mask, and default gateway so it knows where to send traffic. The default gateway points to the ASA interface on the same subnet.

  • Click on PC0 to open its configuration window.
  • Click the Desktop tab, then click IP Configuration.
  • Enter the following values:
  • Close PC0's window.
  • Click on PC1 and open Desktop > IP Configuration.
  • Enter the following values:
  • Close PC1's window.
  • Click on the Web Server (the server in the DMZ) and open Desktop > IP Configuration.
  • Enter the following values:
  • Close the IP Configuration, but keep the server window open.
  • Still on the Web Server, click the Services tab.
  • Click HTTP in the left menu.
  • Confirm the HTTP service is set to On. If it is off, click the On radio button to enable it.
  • Close the server window.

Why enable HTTP on the web server?

The web server needs to respond to HTTP requests on port 80. Later, you will write a firewall rule that allows outside users to access this server. Without the HTTP service running, there would be nothing to connect to even if the firewall permits the traffic.

  • Click on the Outside PC and open Desktop > IP Configuration.
  • Enter the following values:
  • Close the Outside PC's window.

What is a default gateway?

The default gateway is the IP address a device sends traffic to when the destination is on a different network. In this lab, every device's default gateway is the ASA's interface on its local subnet. This means all cross-zone traffic flows through the firewall, giving it full control over what gets permitted or denied.

Typed the wrong IP on a device?

Click the device again, go to Desktop > IP Configuration, and overwrite the incorrect value. There is no save button needed. The values take effect immediately.

help me fix IP addressing on my Packet Tracer devices

Your topology is built and every device has an address. Next up, you will configure the ASA firewall itself, assigning security levels to each zone and telling the firewall which physical port belongs to which network.

Configure the ASA Firewall

Your network topology is in place with all devices cabled and addressed. Now it's time to bring the firewall to life.

The ASA 5505 needs to know which interfaces belong to which security zone. You'll configure VLANs to create three distinct zones, each with a different trust level that controls how traffic flows between them.

In this step, get ready to:
  • Configure VLAN interfaces with security zone names and levels.
  • Assign physical Ethernet ports to the correct VLANs.
  • Verify all interfaces are up and correctly addressed.
Configure VLANs and interfaces

Security levels are the core of how the ASA decides what traffic is allowed. A higher number means more trust. Inside gets 100 (most trusted), Outside gets 0 (least trusted), and the DMZ sits at 50 in between.

  • Click the ASA 5505 device in your workspace to open its properties.
  • Click the CLI tab at the top of the device window.
  • Configure the three VLAN interfaces by entering these commands:
enable
configure terminal

interface Vlan 1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 no shutdown

interface Vlan 2
 nameif outside
 security-level 0
 ip address 203.0.113.1 255.255.255.0
 no shutdown

interface Vlan 3
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
 no shutdown

What do these commands do?

  • enable enters privileged EXEC mode, and configure terminal enters global configuration mode where you can make changes.
  • nameif gives each VLAN a human-readable zone name (inside, outside, dmz) that you'll reference in all future rules.
  • security-level sets the trust level for each zone. Traffic flowing from a higher level to a lower level is allowed by default. Traffic from lower to higher is denied by default.
  • ip address assigns the gateway IP for each zone's subnet. Devices in each zone use this IP as their default gateway.

Why does traffic flow direction matter?

The ASA's security level system means Inside (100) can reach Outside (0) without any explicit rule. But Outside (0) cannot reach Inside (100) unless you write an Access Control List that permits it.

This is the principle of defense in depth. The default posture is "deny unless explicitly allowed," which protects your most sensitive assets.

You should see the CLI accept each command without errors. If you see INFO: Security level for "inside" set to 100 messages appear, that confirms the ASA is registering your security zones.

Seeing an error after a command?

  • If you see Invalid input detected, check for typos. Each command must be entered exactly as shown, including the single space before subcommands like nameif.
  • If you see a > prompt instead of (config)#, you forgot to type enable and configure terminal first.

Help me troubleshoot an ASA CLI error in Packet Tracer

Assign physical ports to VLANs

The ASA 5505 uses an internal switch to map physical Ethernet ports to VLANs. Each port needs to be told which VLAN it belongs to so traffic arriving on that port gets associated with the correct security zone.

  • Still in the CLI tab, assign each physical port to its VLAN by entering these commands:
interface Ethernet 0/0
 switchport access vlan 2
 no shutdown

interface Ethernet 0/1
 switchport access vlan 1
 no shutdown

interface Ethernet 0/2
 switchport access vlan 3
 no shutdown

What does this code do?

  • Ethernet 0/0 connects to VLAN 2 (outside). This is the port your Outside PC is plugged into.
  • Ethernet 0/1 connects to VLAN 1 (inside). This is the port your Inside switch is plugged into.
  • Ethernet 0/2 connects to VLAN 3 (dmz). This is the port your DMZ switch is plugged into.
  • switchport access vlan tells the physical port which VLAN it belongs to. no shutdown activates the port.

The CLI should accept each command without errors. You now have the physical-to-logical mapping complete.

Port not accepting the VLAN assignment?

  • Make sure you're still in configuration mode. Your prompt should show (config)# or (config-if)#. If you see just #, type configure terminal again.
  • Check that you're using the correct port numbers. Ethernet 0/0 is the port connected to the Outside PC, Ethernet 0/1 to the Inside switch, and Ethernet 0/2 to the DMZ switch.

Help me fix my ASA port-to-VLAN assignment

Verify interface configuration

Before moving on, confirm that all three interfaces are active and have the correct IP addresses assigned.

  • Check the interface status by running this command in the CLI:
show interface ip brief
  • Confirm all three interfaces show their assigned IP addresses and are in an "up" state:
  • Vlan 1 (inside): 192.168.1.1 and up.
  • Vlan 2 (outside): 203.0.113.1 and up.
  • Vlan 3 (dmz): 172.16.1.1 and up.

Interface showing down?

  • If an interface shows "down", go back and check that you included no shutdown for both the VLAN interface and the physical Ethernet port assigned to it.
  • If an interface is missing its IP address, re-enter the interface Vlan commands for that zone. You can type them again without causing issues.
  • Check that the cables in your topology are connected to the correct ASA ports. If a cable is on Ethernet 0/3 instead of Ethernet 0/2, the DMZ traffic won't reach VLAN 3.

Help me fix my ASA interface that's showing down

✔️ Awesome, I've got everything!

Great. Double check that you see all three interfaces showing "up" in the output before moving on.

ⓧ I'd like to double check the full code

Here is the complete set of commands you should have entered on the ASA 5505 in this step:

enable
configure terminal

interface Vlan 1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 no shutdown

interface Vlan 2
 nameif outside
 security-level 0
 ip address 203.0.113.1 255.255.255.0
 no shutdown

interface Vlan 3
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
 no shutdown

interface Ethernet 0/0
 switchport access vlan 2
 no shutdown

interface Ethernet 0/1
 switchport access vlan 1
 no shutdown

interface Ethernet 0/2
 switchport access vlan 3
 no shutdown

Your ASA firewall now has three fully configured security zones. Next up, you'll configure NAT and ACL rules that control exactly which traffic is allowed to flow between these zones.

Configure NAT and ACL Rules

Your firewall interfaces are up and each zone has its own IP range. But right now, traffic still can't flow between zones in a useful way.

Internal PCs need to reach the internet, and external users need to access your web server. NAT (Network Address Translation) handles the address translation, while ACLs (Access Control Lists) decide exactly which traffic is permitted or denied.

In this step, get ready to:
  • Configure NAT rules so inside users can reach the internet and outside users can reach your web server.
  • Create ACLs that enforce least-privilege access from the outside zone.
  • Verify your NAT and ACL configuration with show commands.
Configure NAT for outbound internet access

Without NAT, your inside PCs use private IP addresses that the internet cannot route back to. NAT translates those private addresses into routable public addresses so return traffic can find its way home.

  • Switch back to the ASA 5505 CLI tab in Packet Tracer.
  • Confirm you see the (config)# prompt. If you see just #, type configure terminal to re-enter global configuration mode.
  • Enter the following NAT configuration:
object network INSIDE-NET
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

object network DMZ-SERVER
 host 172.16.1.10
 nat (dmz,outside) static 203.0.113.10

What do these NAT rules do?

  • INSIDE-NET defines your entire inside subnet (192.168.1.0/24). The nat (inside,outside) dynamic interface rule uses Port Address Translation (PAT) to map all inside PCs to the ASA's outside IP when they access the internet.
  • DMZ-SERVER defines your web server (172.16.1.10). The nat (dmz,outside) static 203.0.113.10 rule gives the server a fixed public IP (203.0.113.10) so outside users always know where to reach it.

Seeing a syntax error?

  • Make sure you press Enter after each line. The subnet and nat lines must be entered while inside the object network context (you'll see the prompt change to (config-network-object)#).
  • If you see ERROR: % Invalid input, check that you have a single space before subnet, host, and nat. These commands are entered inside the object context, not at the top-level (config)# prompt.
  • help me troubleshoot my NAT configuration on the ASA 5505
Configure ACLs for traffic control

The ASA's security levels already let inside traffic flow outward by default (higher to lower is permitted). But outside traffic heading inward is blocked unless you explicitly allow it with an ACL.

  • Create the ACL and apply it to the outside interface by entering these commands:
access-list OUTSIDE-IN extended permit tcp any host 203.0.113.10 eq 80
access-list OUTSIDE-IN extended permit icmp any host 203.0.113.10
access-list OUTSIDE-IN extended deny ip any any

access-group OUTSIDE-IN in interface outside

What do these ACL rules do?

  • Line 1 permits HTTP traffic (TCP port 80) from anywhere to your web server's public NAT address (203.0.113.10).
  • Line 2 permits ICMP (ping) to the web server so you can verify connectivity from outside.
  • Line 3 denies all other inbound traffic. This is the explicit deny-all that enforces least-privilege access.
  • The access-group command applies the ACL named OUTSIDE-IN to traffic arriving on the outside interface.

Together, these rules mean only web traffic and pings can reach your DMZ server from the internet. Everything else is dropped.

Why not add an ACL for inside-to-outside traffic?

The ASA permits traffic flowing from a higher security level to a lower one by default. Your inside zone has security-level 100 and outside has security-level 0, so inside users can already reach the internet without an explicit permit rule.

ACL commands rejected?

  • Verify you are still at the (config)# prompt. If you accidentally entered an object network context from the previous substep and didn't exit, type exit to return to global config.
  • Double-check the IP address 203.0.113.10 in each rule matches the static NAT address you just configured for the DMZ server.
  • help me fix my ACL configuration on the ASA 5505
Verify your configuration
  • Confirm your NAT and ACL rules are active by running these show commands:
show access-list
show nat
show running-config

What should I see?

  • show access-list displays your three OUTSIDE-IN entries (permit tcp, permit icmp, deny ip). Each line has a hit count that will increase as traffic is processed.
  • show nat displays both NAT rules: the dynamic PAT for INSIDE-NET and the static NAT for DMZ-SERVER.
  • show running-config shows the full running configuration. Scroll through to confirm your interface, NAT, and ACL sections are all present.

NAT or ACL rules not showing up?

  • If show nat shows no entries, re-enter the object network commands from Substep 1. A typo in the object name or missing subnet/host line means the NAT rule won't attach.
  • If show access-list is empty, make sure you also ran the access-group OUTSIDE-IN in interface outside command to apply the list.
  • help me verify my ASA NAT and ACL configuration in Packet Tracer

✔️ Awesome, I've got everything!

Great. Double check you haven't missed any commands by confirming all three ACL entries and both NAT rules appear in your show output.

ⓧ I'd like to double check the full code

Here is the complete ASA configuration including all commands from Steps 3 and 4:

enable
configure terminal

interface Vlan 1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 no shutdown

interface Vlan 2
 nameif outside
 security-level 0
 ip address 203.0.113.1 255.255.255.0
 no shutdown

interface Vlan 3
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
 no shutdown

interface Ethernet 0/0
 switchport access vlan 2
 no shutdown

interface Ethernet 0/1
 switchport access vlan 1
 no shutdown

interface Ethernet 0/2
 switchport access vlan 3
 no shutdown

object network INSIDE-NET
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

object network DMZ-SERVER
 host 172.16.1.10
 nat (dmz,outside) static 203.0.113.10

access-list OUTSIDE-IN extended permit tcp any host 203.0.113.10 eq 80
access-list OUTSIDE-IN extended permit icmp any host 203.0.113.10
access-list OUTSIDE-IN extended deny ip any any

access-group OUTSIDE-IN in interface outside

end

Your firewall now knows how to translate addresses and which traffic to allow or deny. Next up, you'll put these rules to the test by sending traffic between zones and watching the ASA permit or drop packets in real time.

Test and Verify Security Policies

Your ASA firewall is fully configured with three security zones, NAT rules, and ACLs. The real question is whether it actually enforces the access policies you designed.

In this step, you will run connectivity tests from different zones to prove your firewall allows legitimate traffic and blocks everything else. You will also use Packet Tracer's Simulation Mode to visually trace how packets are processed, dropped, or translated by the ASA.

In this step, get ready to:
  • Test allowed traffic from Inside to DMZ and Outside zones.
  • Test that blocked traffic is properly denied by the firewall.
  • Use Simulation Mode to trace how the ASA drops and permits packets.
Test allowed traffic

The ASA's security levels dictate default traffic flow. Traffic from a higher security level to a lower one is allowed by default. Your ACL also explicitly permits certain outside traffic to the DMZ web server. Let's prove both of these work.

  • Click PC0 in the workspace to open it.
  • Click the Desktop tab.
  • Click Command Prompt.
  • Test connectivity to the DMZ web server by typing this command and pressing Enter:
ping 172.16.1.10

You should see replies coming back, confirming that Inside (security-level 100) can reach DMZ (security-level 50).

  • Now test connectivity to the Outside PC by typing this command:
ping 203.0.113.20

You should see successful replies. Inside traffic flows to Outside by default because security-level 100 is higher than security-level 0.

What do these results prove?

The ASA allows traffic flowing from higher security levels to lower ones without an explicit permit rule. Your Inside PCs (level 100) can reach both the DMZ (level 50) and Outside (level 0) zones.

The NAT rule you configured translates Inside addresses to the ASA's outside interface IP before sending them out. This is called Port Address Translation (PAT).

Now test from the Outside zone to verify the ACL permits traffic to the web server.

  • Close PC0 and click Outside PC in the workspace.
  • Click the Desktop tab, then click Web Browser.
  • In the URL field, type http://203.0.113.10 and press Go.

You should see the Cisco Packet Tracer default web page load. This confirms your static NAT rule translates the public IP 203.0.113.10 to the DMZ server at 172.16.1.10, and your ACL permits HTTP traffic on port 80.

  • Close the Web Browser and click Command Prompt on the Outside PC.
  • Test ICMP connectivity to the web server by typing:
ping 203.0.113.10

You should see successful replies. Your ACL explicitly permits ICMP to the DMZ server's public address.

Pings timing out?

If your pings from PC0 fail, check that the Inside switch is connected to the ASA on Ethernet 0/1 (VLAN 1). Also verify PC0's default gateway is set to 192.168.1.1.

If the Outside PC cannot reach the web server, click the ASA and verify your NAT and ACL configuration by running show nat and show access-list in the CLI tab.

Help me troubleshoot why my pings are failing between security zones on the ASA.

Test blocked traffic

Proving that allowed traffic works is only half the story. A firewall's real value is what it blocks. Now you will verify that unauthorized traffic is denied.

  • On the Outside PC's Command Prompt, attempt to ping an Inside host by typing:
ping 192.168.1.10

This should fail with "Request timed out" messages. The ASA blocks all traffic from Outside (security-level 0) to Inside (security-level 100) because no ACL permits it.

  • Close the Command Prompt and open the Web Browser on the Outside PC again.
  • In the URL field, type http://192.168.1.10 and press Go.

The page should fail to load. Even though the Inside PCs exist, the firewall has no rule allowing Outside traffic to reach them.

  • Now test from the DMZ. Close the Outside PC and click the Web Server (DMZ) in the workspace.
  • Click the Desktop tab, then click Command Prompt.
  • Try to ping an Inside host by typing:
ping 192.168.1.10

This should also fail. The DMZ (security-level 50) cannot reach Inside (security-level 100) because traffic from a lower security level to a higher one is denied by default.

Why does DMZ-to-Inside fail without an explicit deny rule?

The ASA's security model automatically blocks traffic moving from a lower security level to a higher one. Your DMZ is level 50 and Inside is level 100. No explicit deny rule is needed because the ASA's default behavior handles it.

This is different from a standard router, where all traffic is forwarded unless you add ACLs to block it. The ASA's zone-based approach provides defense in depth by default.

Seeing replies when you expected a timeout?

If Outside or DMZ pings to Inside hosts succeed, check that Ethernet 0/0 is assigned to VLAN 2 (outside) and Ethernet 0/2 is assigned to VLAN 3 (dmz). Swapped port assignments would place devices in the wrong zone.

Also verify your ACL is applied to the correct interface by running show running-config on the ASA and looking for access-group OUTSIDE-IN in interface outside.

Help me figure out why traffic that should be blocked is getting through my ASA firewall.

Use Simulation Mode to trace packets

Packet Tracer's Simulation Mode lets you watch individual packets travel through your network one hop at a time. You can see exactly where the ASA drops a blocked packet and where it permits and translates an allowed one.

  • Close any open device windows.
  • Switch to Simulation Mode by clicking the stopwatch icon in the bottom-right corner of the workspace. It is partially hidden behind the Realtime tab.
  • Click Edit Filters in the Simulation Panel. Click Show All/None to deselect all protocols, then check only ICMP under the IPv4 tab. This filters out noise so you only see ping packets.

Why filter protocols?

Without filtering, the Simulation Panel fills with background traffic like ARP and STP frames. Filtering to ICMP only keeps the Event List clean so you can follow your test packets step by step.

First, trace a blocked packet to see the ASA drop it.

  • Click the Add Simple PDU button (closed envelope icon) in the right toolbar.
  • Click Outside PC as the source device.
  • Click PC0 (Inside) as the destination device. A colored envelope appears beside Outside PC.
  • Click Capture/Forward repeatedly to step the packet through the network one hop at a time.

Watch the packet travel from Outside PC to the ASA. At the ASA, the packet is dropped. The Event List shows the ASA denying the ICMP request because no rule permits Outside-to-Inside traffic.

  • Click Reset Simulation in the Simulation Panel to clear the event list.

Now trace an allowed packet to see the ASA permit and NAT-translate it.

  • Click Edit Filters again. Under the Misc tab, also check HTTP to capture web traffic.
  • Click the Add Simple PDU button again.
  • Click Outside PC as the source.
  • Click the Web Server (DMZ) as the destination.
  • Click Capture/Forward repeatedly to trace the packet through the network.

Watch the packet arrive at the ASA. The ASA permits it (matching your ACL rule), translates the destination from 203.0.113.10 to 172.16.1.10 via static NAT, and forwards it to the DMZ web server.

What did you just observe?

Simulation Mode gave you visual proof of two critical firewall behaviors. First, the ASA silently drops packets that violate its security policy. Second, for permitted packets, it performs address translation before forwarding.

This step-by-step visibility is something you cannot get on real hardware without packet capture tools like Wireshark. Packet Tracer makes the invisible visible.

  • Switch back to Realtime mode by clicking the Realtime tab in the bottom-right corner.
  • Save your Packet Tracer file by pressing Ctrl+S (Windows). Choose a location and filename you will remember.

Simulation Panel looks empty or cluttered?

If the Event List is empty after clicking Capture/Forward, make sure you selected the correct source and destination devices when creating the PDU. The envelope icon should appear next to the source device.

If the list is full of unrelated events, click Edit Filters and deselect everything except ICMP (and HTTP for the second trace). Then click Reset Simulation and try again.

Help me understand why my Simulation Mode trace is not showing the expected results.

Secret mission

Map Controls to NIST Cybersecurity Framework

You've built the technical controls. Now prove you can communicate their value to leadership. Create a governance document that maps your firewall configuration to the NIST Cybersecurity Framework, bridging the gap between technical implementation and compliance reporting.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your resources for future practice, pause by closing the application, or delete everything entirely.

Resources you used:

  • Cisco Packet Tracer application (installed on your PC).
  • Saved .pkt topology file with your configured ASA firewall.
  • NIST CSF controls mapping document, risk statement, and security policy document.

Keep everything running

No action needed. Choose this if you plan to continue experimenting with your firewall lab or want to build on it for future certifications.

  • Your .pkt file stays wherever you saved it. You can reopen it anytime in Packet Tracer.
  • Your NIST CSF mapping, risk statement, and security policy documents remain on your machine.
  • Cisco Packet Tracer stays installed and ready for future labs.
  • Your Cisco SkillsForAll account remains active and gives you access to additional free courses.

Pause - I'll come back to this later

Close Cisco Packet Tracer to free up system memory. Your files stay safe on disk for when you return.

  • Close Cisco Packet Tracer if it is open.
  • Your .pkt file and documentation files remain saved on your PC.
  • Packet Tracer uses no resources when closed, so there is nothing else to pause.

Delete - I don't want to use this again

Remove all project files and uninstall Cisco Packet Tracer from your system.

  • Delete your saved .pkt topology file from wherever you saved it on your PC.
  • Delete your NIST CSF controls mapping document, risk statement, and security policy document.
  • Uninstall Cisco Packet Tracer by opening Windows Settings (press Windows Key + I).
  • Click Apps, then Apps & features.
  • Search for Cisco Packet Tracer in the list, click it, and click Uninstall.
  • Confirm the uninstall and follow the on-screen prompts to complete removal.

What about my SkillsForAll account?

Your Cisco SkillsForAll account is free and gives you access to other networking courses. There is no self-service delete button in the SkillsForAll dashboard.

If you want to delete your account data, submit a privacy request at https://privacyrequest.cisco.com.

Nice Work!

Nice Work!

You just designed, built, and verified a multi-zone enterprise network protected by a Cisco ASA 5505 firewall. You now have hands-on proof that you can implement the network security controls tested on Network+ and Security+.

You've learned how to:

  • Build a three-zone network topology with an ASA firewall separating Inside (security-level 100), DMZ (security-level 50), and Outside (security-level 0) zones.
  • Configure NAT and ACLs to enforce least-privilege traffic flow, translating internal addresses for internet access and permitting only specific inbound connections to the DMZ.
  • Verify security policies through connectivity tests and Packet Tracer's Simulation Mode, proving that allowed traffic passes and unauthorized traffic is dropped.
  • Secret Mission: Mapped your technical controls to the NIST Cybersecurity Framework and created governance documentation combining technical firewall skills with GRC practices.

Ready to quiz yourself?