--- title: netlab: Sample Cisco ASAv Topology « ipSpace.net blog description: A walkthrough for building a sample Cisco ASAv topology using netlab, featuring an outside router, a firewall, and an inside router with hosts. The topology... canonical: https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: netlab: Sample Cisco ASAv Topology « ipSpace.net blog | daily.dev og:description: A walkthrough for building a sample Cisco ASAv topology using netlab, featuring an outside router, a firewall, and an inside router with hosts. The topology... og:url: https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk og:image: https://api.daily.dev/og/posts/IFiKXvrLk.png og:image:alt: netlab: Sample Cisco ASAv Topology « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # netlab: Sample Cisco ASAv Topology « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 6 min read · 0 upvotes · 0 comments ## Summary A walkthrough for building a sample Cisco ASAv topology using netlab, featuring an outside router, a firewall, and an inside router with hosts. The topology uses BGP routing with FRR containers, where the external router advertises a default BGP route that ASAv propagates to the internal router. Key caveats are noted: ASAv has limited netlab support (only IS-IS and BGP), netlab lacks static route support, and firewall-specific features (zones, NAT, ACLs) require manual configuration. The post includes the full topology YAML, BGP table output confirming route propagation, and the additional ASAv ACL/policy-map config needed to allow internal hosts to ping external ones. A workaround for ASAv's legacy SSH algorithms is also covered, with a fix noted for netlab release 1.9.3. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I configure a Cisco ASAv topology in netlab with inside and outside routers using BGP? Define a netlab topology with the bgp module and bgp.session plugin. Create an outside router (FRR container) that advertises a BGP default route via bgp.default_originate, an ASAv firewall node, and an inside router. ASAv supports BGP so it can propagate the default route inward. Firewall ACLs, security levels, and ICMP inspection must be added manually via custom config templates since netlab does not configure firewall-specific features. _Network engineers building ASAv labs track netlab topology patterns and workarounds on daily.dev._ ### How do I fix SSH connection issues with Cisco ASAv in netlab due to legacy cryptographic algorithms? ASAv uses obsolete SSH key exchange and encryption mechanisms that modern SSH clients reject. In netlab release 1.9.2, set defaults.devices.asav.group_vars.netlab_ssh_args to '-o KexAlgorithms=+diffie-hellman-group14-sha1 -o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=+ssh-rsa' in the topology file. Alternatively, edit ~/.ssh/config to permit those algorithms. A permanent fix ships in netlab release 1.9.3. _Engineers running ASAv labs find netlab version-specific workarounds like this faster on daily.dev._ ## Similar posts on daily.dev - [EVPN with SR-MPLS Core « ipSpace.net blog](https://daily.dev/posts/evpn-with-sr-mpls-core-ipspace-net-blog-taobtibzc) · ipSpace.net Blog · 0 upvotes · 0 comments - [BGP-Free Core with SR-MPLS « ipSpace.net blog](https://daily.dev/posts/bgp-free-core-with-sr-mpls-ipspace-net-blog-h7kronzy3) · ipSpace.net Blog · 0 upvotes · 0 comments --- Tags: [#networking](https://daily.dev/tags/networking), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"netlab: Sample Cisco ASAv Topology « ipSpace.net blog","url":"https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk"},"datePublished":"2026-08-11T08:52:02.523Z","dateModified":"2026-08-11T08:55:51.991Z","description":"A walkthrough for building a sample Cisco ASAv topology using netlab, featuring an outside router, a firewall, and an inside router with hosts. The topology...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4dc90e5811140b766ae7c95fb2b68207?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4dc90e5811140b766ae7c95fb2b68207?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"networking,bgp","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"netlab: Sample Cisco ASAv Topology « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/netlab-sample-cisco-asav-topology-ipspace-net-blog-ifikxvrlk#faq","mainEntity":[{"@type":"Question","name":"How do I configure a Cisco ASAv topology in netlab with inside and outside routers using BGP?","acceptedAnswer":{"@type":"Answer","text":"Define a netlab topology with the bgp module and bgp.session plugin. Create an outside router (FRR container) that advertises a BGP default route via bgp.default_originate, an ASAv firewall node, and an inside router. ASAv supports BGP so it can propagate the default route inward. Firewall ACLs, security levels, and ICMP inspection must be added manually via custom config templates since netlab does not configure firewall-specific features. Network engineers building ASAv labs track netlab topology patterns and workarounds on daily.dev."}},{"@type":"Question","name":"How do I fix SSH connection issues with Cisco ASAv in netlab due to legacy cryptographic algorithms?","acceptedAnswer":{"@type":"Answer","text":"ASAv uses obsolete SSH key exchange and encryption mechanisms that modern SSH clients reject. In netlab release 1.9.2, set defaults.devices.asav.group_vars.netlab_ssh_args to '-o KexAlgorithms=+diffie-hellman-group14-sha1 -o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=+ssh-rsa' in the topology file. Alternatively, edit ~/.ssh/config to permit those algorithms. A permanent fix ships in netlab release 1.9.3. Engineers running ASAv labs find netlab version-specific workarounds like this faster on daily.dev."}}]} ```