Using the internet isn't optional for most companies - and that means users being able to leave the internal networks for the outside world and receiving replies. But you can imagine why that's usually not very useful. The only way to keep a network absolutely safe is to allow absolutely no connection to the internet.

When a network has an ASA protecting it, outside traffic gets stopped before it can even make its way to any device on the network. And so the ASA, by default, says that any traffic trying to come in from the outside, whether that's a user, a server or a system, is going to be denied at the connection to the ASA. We all know that the outside world is a dangerous place. Imagine a network and give it an 'inside' zone and a 'de-militarized zone' (DMZ) of several servers that touch the internet, then put an ASA in-between the network and the Internet – protecting the entire network.

To understand what an ASA does on a network, let's picture one. A Cisco Adaptive Security Appliance, or ASA, is especially powerful because it bundles many features and capabilities into one network security device. Different hardware and software solutions offer unique protections. In the world of cybersecurity, there are many types of protection. But Cisco has also built ASAs to have highly intelligent and robust capabilities that can recognize permissible traffic of many different types. Rogue actors can't perform mischief if they never get in from the outside in the first place. If you are using encryption or authentication algorithms with a key length of 256 bits or greater, use Diffie-Hellman group 21.Watch now How Does an ASA Secure a Network?Ī Cisco Adaptive Security Appliance's (ASA) default behavior is to prevent all external traffic from entering a network. ' Guideline: If you are using encryption or authentication algorithms with a 128-bit key, use Diffie-Hellman groups 5,14,19,20, or 24. IBM z/OS IPSec Documentation - quote from article follows

I also find the following IBM document helpful: I appreciate the info on newer DH groups for ASA.

Asa 5505