How to Add Firewall in Cisco Packet Tracer

Network segmentation and perimeter defense are core pillars of modern network design, but practicing them requires a realistic testing ground. Cisco Packet Tracer provides virtualized environments where you can deploy and configure security appliances without risking production hardware. Adding a firewall in Packet Tracer introduces stateful packet inspection, granular access control lists (ACLs), network address translation (NAT), and demilitarized zones (DMZs) to your topologies.

Whether you are preparing for certification exams or designing an enterprise network prototype, this guide walks you through locating firewall appliances in Packet Tracer, comparing deployment models, executing baseline and DMZ configurations, troubleshooting common traffic drop issues, and utilizing ready-to-run lab templates.

Locating and Adding Firewalls in Cisco Packet Tracer

To incorporate a dedicated firewall into your topology, you must locate the hardware appliances within the Packet Tracer device catalog. The software organizes equipment into primary categories and nested sub-categories along the bottom-left tool tray.

Follow these steps to find and place a firewall:

1. Select Network Devices: Click the Network Devices icon in the bottom-left corner of the workspace (represented by a router and switch icon).
2. Navigate to Security Devices: In the sub-category row directly beneath the primary category, click the Security icon (represented by a padlock or security shield).
3. Inspect the Available Models: The device selection box displays the available hardware appliances:
4. Cisco ASA 5506-X: The default next-generation hardware platform in modern Packet Tracer releases (version 7.x and 8.x). It features routed Layer 3 physical interfaces labeled GigabitEthernet 1/1 through GigabitEthernet 1/8.
5. Cisco ASA 5505: A legacy small-office appliance available in earlier and backwards-compatible lab environments. It features an integrated 8-port switch (Ethernet 0/0 to Ethernet 0/7) where ports operate as Layer 2 switchports assigned to Switched Virtual Interfaces (interface Vlan1, interface Vlan2).
6. Industrial Security Appliances (e.g., ISA-3000): Ruggedized security devices found in specialized IoT and industrial networking activities.
7. Deploy to the Canvas: Click on the ASA 5506-X (recommended for standard labs) or ASA 5505, drag it onto the main canvas, and allow the virtual appliance to complete its initial boot sequence.

Once placed on the workspace, clicking the appliance and opening the CLI tab gives you direct access to the ASA terminal console.

Dedicated ASA Appliance vs. Router Zone-Based Firewall

Before committing to a hardware firewall topology, determine whether your design calls for a dedicated appliance like the Cisco ASA or software-driven security implemented on an existing Cisco IOS router using Zone-Based Policy Firewall (ZBF). Both methods can be simulated in Packet Tracer, but their architectural logic, configuration overhead, and traffic filtering mechanisms differ significantly.

For authentic security appliance experience and cleaner network segmentation, deploying the dedicated Cisco ASA appliance is the preferred approach for most Packet Tracer topologies.

Step-by-Step Basic ASA Firewall Configuration

With your ASA firewall placed on the canvas, connect it to your network infrastructure and configure its core interfaces, security levels, routing, and dynamic translation.

In this foundational setup, we use an ASA 5506-X connecting an internal LAN (192.168.1.0/24) to an external ISP/Internet router (203.0.113.0/24).

[Inside PC: 192.168.1.10]
           |
   [LAN Switch: 2960]
           |
(Gi 1/1) [ASA 5506-X Firewall] (Gi 1/2)
           |
 [Border Router / ISP: 203.0.113.1]

Step 1: Cable the Appliance

1. Select the Connections category (the lightning bolt icon).
2. Choose a Copper Straight-Through cable.
3. Connect the LAN switch to GigabitEthernet 1/1 on the ASA.
4. Connect GigabitEthernet 1/2 on the ASA to the border router’s incoming interface.

Step 2: Access the Terminal and Enter Privileged Mode

Click the ASA appliance, select the CLI tab, press Enter, and escalate privileges (the factory default enable password is blank):

ciscoasa> enable
Password: 
ciscoasa# configure terminal
ciscoasa(config)# hostname ASA-EDGE

Step 3: Configure the Inside Interface

Assign the internal network parameters. Specifying the name inside automatically sets the security level to 100:

ASA-EDGE(config)# interface GigabitEthernet 1/1
ASA-EDGE(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ASA-EDGE(config-if)# ip address 192.168.1.1 255.255.255.0
ASA-EDGE(config-if)# no shutdown
ASA-EDGE(config-if)# exit

Step 4: Configure the Outside Interface

Assign the external facing parameters. Setting the name to outside automatically sets the security level to 0:

ASA-EDGE(config)# interface GigabitEthernet 1/2
ASA-EDGE(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ASA-EDGE(config-if)# ip address 203.0.113.2 255.255.255.0
ASA-EDGE(config-if)# no shutdown
ASA-EDGE(config-if)# exit

Step 5: Configure the Default Gateway

Point outbound traffic toward your upstream ISP gateway address (203.0.113.1):

ASA-EDGE(config)# route outside 0.0.0.0 0.0.0.0 203.0.113.1

Step 6: Enable Dynamic Port Address Translation (PAT)

Because internal hosts use private RFC 1918 addresses, define an object network rule so all outbound traffic translates to the public IP address of the outside interface:

ASA-EDGE(config)# object network OBJ_INSIDE_SUBNET
ASA-EDGE(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA-EDGE(config-network-object)# nat (inside,outside) dynamic interface
ASA-EDGE(config-network-object)# exit

At this stage, internal hosts can initiate outbound TCP and UDP connections to the Internet, and return packets will be statefully allowed back through the firewall.

Advanced Security Policies: Configuring DMZ, Access Lists, and Stateful Inspection

Enterprise networks rarely connect only two zones. A Demilitarized Zone (DMZ) isolates public-facing servers—such as web and mail servers—from both the untrusted Internet and the sensitive corporate internal network.

Building on the basic setup, we will connect a DMZ web server (172.16.1.10) to interface GigabitEthernet 1/3 and establish directional security policies.

       [Inside LAN (Security 100)]
                  |
             (Gi 1/1)
[Outside (Security 0)] --- [ASA Firewall] --- (Gi 1/3) [DMZ Server (Security 50)]
             (Gi 1/2)

Step 1: Initialize the DMZ Interface

Assign an intermediate security level (typically 50). This ensures the DMZ has higher trust than the outside world (0), but lower trust than the internal LAN (100):

ASA-EDGE(config)# interface GigabitEthernet 1/3
ASA-EDGE(config-if)# nameif dmz
ASA-EDGE(config-if)# security-level 50
ASA-EDGE(config-if)# ip address 172.16.1.1 255.255.255.0
ASA-EDGE(config-if)# no shutdown
ASA-EDGE(config-if)# exit

Under this hierarchy:
– Inside (100) to DMZ (50): Permitted by default.
– DMZ (50) to Outside (0): Permitted by default.
– Outside (0) to DMZ (50): Blocked by default.
– DMZ (50) to Inside (100): Blocked by default.

Step 2: Create an Access Control List (ACL) for Inbound Traffic

To allow external clients on the Internet to view pages hosted on your DMZ web server (172.16.1.10), create an extended access list permitting HTTP (port 80) and HTTPS (port 443) traffic:

ASA-EDGE(config)# access-list OUTSIDE_TO_DMZ extended permit tcp any host 172.16.1.10 eq 80
ASA-EDGE(config)# access-list OUTSIDE_TO_DMZ extended permit tcp any host 172.16.1.10 eq 443

Step 3: Bind the Access List to the Outside Interface

Apply the access list to inbound traffic arriving at the outside interface using the access-group command:

ASA-EDGE(config)# access-group OUTSIDE_TO_DMZ in interface outside

Step 4: Configure Global ICMP Stateful Inspection

By default, the Cisco ASA does not inspect ICMP packets statefully. When an inside client pings an external host, the outgoing echo-request passes, but the returning echo-reply is dropped at the outside interface.

Enable ICMP inspection within the default global policy map so all echo replies are automatically tracked and permitted:

ASA-EDGE(config)# policy-map global_policy
ASA-EDGE(config-pmap)# class inspection_default
ASA-EDGE(config-pmap-c)# inspect icmp
ASA-EDGE(config-pmap-c)# exit
ASA-EDGE(config-pmap)# exit

Troubleshooting Packet Tracer Firewall Drops and Connectivity Failures

When packets fail to transit the firewall during verification, the issue almost always stems from default security level enforcement, missing stateful inspection, or NAT misconfigurations. Here are the most common failure scenarios and their solutions.

Why can internal hosts ping the ASA inside interface, but pings to the outside router time out?

This occurs because the ASA does not track ICMP statefully out of the box. While the outbound ICMP Echo Request reaches the destination router and triggers a reply, the firewall drops the inbound Echo Reply at the outside interface as unsolicited traffic.

To resolve this, enable ICMP inspection in the modular policy framework as shown previously:

ASA-EDGE(config)# policy-map global_policy
ASA-EDGE(config-pmap)# class inspection_default
ASA-EDGE(config-pmap-c)# inspect icmp

Why is HTTP traffic dropped from inside to outside even though security levels permit it?

Even though traffic flowing from a security level of 100 to 0 is allowed by default, outside routers cannot route return packets back to private IP addresses (such as 192.168.1.0/24). If NAT or PAT is omitted, the outside router drops the return packet or sends it to a dead end.

Verify that dynamic PAT is bound between the inside and outside interfaces:

ASA-EDGE(config)# object network OBJ_INSIDE_SUBNET
ASA-EDGE(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA-EDGE(config-network-object)# nat (inside,outside) dynamic interface

Why are packets dropped between two interfaces configured with the exact same security level?

By default, the ASA blocks all traffic between interfaces that share identical security values (for example, two department interfaces both set to security level 50).

To permit communication between interfaces with identical security levels, issue this command in global configuration mode:

ASA-EDGE(config)# same-security-traffic permit inter-interface

If you also need traffic to enter and exit through the same physical interface (such as in hub-and-spoke VPN routing), add:

ASA-EDGE(config)# same-security-traffic permit intra-interface

Why is external traffic unable to reach the DMZ server after defining an ACL?

This failure usually results from one of two oversights:
1. The ACL was not applied with access-group: Defining an access list has no effect until it is bound to an interface (access-group <ACL_NAME> in interface <INTERFACE_NAME>).
2. Missing static NAT mapping: If external users target a public IP address rather than the private server IP, you must configure a static NAT rule translating incoming requests on the public address to the internal DMZ host address (172.16.1.10).

Pre-Built Firewall Lab Blueprint and Configuration Template

Rather than starting from an unconfigured workspace every time, you can construct a baseline Packet Tracer topology and paste this standardized configuration block directly into the ASA console.

Lab Topology Blueprint

• Appliance: Cisco ASA 5506-X
• Inside Network: GigabitEthernet 1/1 → Switch 2960 → PC-0 (192.168.1.10/24, Gateway: 192.168.1.1)
• Outside Network: GigabitEthernet 1/2 → Router ISR4321 (203.0.113.1/24)
• DMZ Network: GigabitEthernet 1/3 → Server-0 (172.16.1.10/24, Gateway: 172.16.1.1)

Master CLI Deployment Script

Copy and paste this script directly into the privileged EXEC prompt (ciscoasa#) to initialize interfaces, routing, NAT, DMZ access, and stateful inspection:

configure terminal

! --- Hostname Configuration ---
hostname ASA-LAB-EDGE

! --- Interface Definitions ---
interface GigabitEthernet 1/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 no shutdown
exit

interface GigabitEthernet 1/2
 nameif outside
 security-level 0
 ip address 203.0.113.2 255.255.255.0
 no shutdown
exit

interface GigabitEthernet 1/3
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0
 no shutdown
exit

! --- Default Route to Provider Gateway ---
route outside 0.0.0.0 0.0.0.0 203.0.113.1

! --- Outbound Dynamic PAT for LAN and DMZ ---
object network OBJ_INTERNAL_LAN
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface
exit

object network OBJ_DMZ_NET
 subnet 172.16.1.0 255.255.255.0
 nat (dmz,outside) dynamic interface
exit

! --- Access Control List for Inbound Web Traffic to DMZ ---
access-list INBOUND_TO_DMZ extended permit tcp any host 172.16.1.10 eq 80
access-list INBOUND_TO_DMZ extended permit tcp any host 172.16.1.10 eq 443
access-group INBOUND_TO_DMZ in interface outside

! --- Enable Stateful ICMP Inspection ---
policy-map global_policy
 class inspection_default
  inspect icmp
 exit
exit

! --- Save Configuration ---
write memory

After pasting this configuration, save your Packet Tracer workspace as a .pkt template file (e.g., ASA_Firewall_Baseline_Lab.pkt). You can reload this file anytime you need a functional, pre-configured sandbox for advanced security testing.

Adding a dedicated firewall in Cisco Packet Tracer bridges the gap between basic route-switch topologies and multi-tiered security architectures. By combining hierarchical security levels, object-based dynamic NAT, isolated DMZ interfaces, and modular ICMP inspection, you can replicate enterprise perimeter defense directly on your desktop. Save your verified topology as a reusable template to rapidly test new security policies, explore advanced access lists, and master stateful packet filtering.

Please follow and like us: