topic Re: Adding ACL in Multicontext Firewall in Network Security

Adding ACL in Multicontext Firewall

mahesh18 — Tue, 12 Mar 2019 02:24:49 GMT

Hi Everyone,

Need to confirm below is the right way to make changes in firewall when they are in multi context mode--Active ,Active

Need to add ACL in 2 firewalls.

Say ASA1 has two contexts admin and a

When i logon to say IP 192.168.1.1 i go to ASA1/admin which is primary ASA and active for context admin.

Context a is standby here.

Here i added the ACL rule under the admin context of ASA1.

Now i log onto second say hostname ASA1

Here say i log onto IP 192..168.1.2 go to ASA/admin which is seconday ASA and admin context is standby here

Context a is active here.

From admin context i will go to context a and get hostname ASA1/aand will add the ACL rule here.

after the above change is done new rule should show up in both the contexts of primary and secondary fws and right?

Best regards

Mahesh

Message was edited by: mahesh parmar

Adding ACL in Multicontext Firewall

Jouni Forss — Mon, 12 Aug 2013 23:41:35 GMT

Hi Mahesh,

So if you have Active/Active ASA pair and several Security Contexts in them then there is really nothing that different from configuring those Security Context compared to configuring an Active/Standby pair.

You basically find/determine the device that is Active for the Security Context you want to configure, log into that device and go into the Security Context and make the required configurations and they will be automatically replicated to the other physical units Standby Security Context.

You should get a warning before configuring anything if you happen to be logged on a unit that is in Standby State

To my understanding as soon as you enter

configure terminal (or conf t)

The ASA will notify you that you are configuring the Standby unit and the commands you will enter wont be replicated to the other unit that is Active for this Context at the moment.

Basically the easiest command to determine the roles of each ASA device for specific Security Context is to use the following command

show failover

When you use it in the System Context space/mode I think you should get listing of that devices State for ALL of the Security Contexts configured on that device.

- Jouni

Re: Adding ACL in Multicontext Firewall

mahesh18 — Tue, 13 Aug 2013 01:42:16 GMT

Hi Jouni,

Thanks for prompt reply.

Best Regards

Mahesh