topic Pinging from System Config - ASA in Multimode in Network Security

Pinging from System Config - ASA in Multimode

mahesh18 — Tue, 12 Mar 2019 01:37:50 GMT

Hi Everyone,

Need to confirm below

ASA is in multi mode say context admin and x.

while in admin context i did below

When i am in context admin i can ping the destination IP from it as it has route for it.

then i ran the command

changeto system

Then i went to System config and i was also able to ping the destination IP from there as well.

So does it mean that from system config we can always ping the IP which has route in other context like admin ?

Thanks

Mahesh

Pinging from System Config - ASA in Multimode

Jouni Forss — Thu, 02 May 2013 18:01:10 GMT

Hi,

The "admin" context is the context used to manage the whole virtual (Multiple Mode) ASA.

The System Context uses the "admin" contexts IP addressing/routing/configurations to reach the services it needs.

- Jouni

Pinging from System Config - ASA in Multimode

mahesh18 — Thu, 02 May 2013 18:04:44 GMT

Hi Jouni,

also need to confirm from system context if i need to ping some destination IP which is pingable from context x will it work?

Regards

Mahesh

Re: Pinging from System Config - ASA in Multimode

Jouni Forss — Thu, 02 May 2013 18:20:22 GMT

Hi,

To my understanding the System Context only uses/has the information of "admin" context when it comes to forming connection from the ASA itself to somewhere.

In other words if the ASA running in Multiple Context mode has to form some connections. For example use NTP or send files with FTP or you simply want to form a SSH management connection TO the virtual ASA then you will be using the routing and configurations of the "admin" context.

System Context cannot be used to test any other Contexts connectivity to somewhere to my understanding.

Or did I missunderstand what you meant?

- Jouni

Pinging from System Config - ASA in Multimode

Jouni Forss — Thu, 02 May 2013 18:26:08 GMT

Here is a quote from Cisco material

The system configuration does not include any network interfaces or network settings for itself; rather, when the system needs to access network resources (such as downloading the contexts from the server), it uses one of the contexts that is designated as the admin context.

Source:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/contexts.html#wp1133678

- Jouni

Pinging from System Config - ASA in Multimode

mahesh18 — Thu, 02 May 2013 18:42:08 GMT

Hi Jouni,

Here is what i tested

Context X has interface IP say 192.168.1.1

I went to the system context and i was able to ping this IP.Is this default behaviour?

So this means that from system context we can reach context X IP.

Also from system context i was able to ping the default gateway for context b.

is this also default behaviour?

Thanks

MAhesh

Pinging from System Config - ASA in Multimode

Jouni Forss — Thu, 02 May 2013 19:33:45 GMT

Hi,

I cant ofcourse be absolultely sure but I can guess

I would guess that the "admin" context is connected to the rest of the network. I mean it has a connection to the same networks as the context "x". This would explain that you are able to PING addresses from the System Context to the Context X.

If you want to confirm this you can try to do the following

Check what interfaces are connected to the "admin" context. You can use the command "show run context admin" in the System Context space.
Check the routing and interface IP addresses in the Context admin
- show run interface
- show route
Also check the routing table of the Context "x" if needed.
With the collected base information you can check if the "admin" contexts interface or interfaces are connected to the same network as the Context "x"

I cant think of anything else at the moment. I think the "admin" context is connected to the same network as the context "x" and thats why you can reach the context "x" network IP addresses also from System Context as it uses the "admin" contexts routing/interface/etc configurations to contact other networks.

Hopefully this helps

- Jouni

Pinging from System Config - ASA in Multimode

mahesh18 — Fri, 03 May 2013 16:05:25 GMT

Hi jouni,

I will try to check above stuff later.

Thanks

Mahesh