topic Counting Context modes in ASA in Network Security

Counting Context modes in ASA

mahesh18 — Tue, 12 Mar 2019 01:22:29 GMT

Hi Everyone,

We have ASA that are running multiple context mode.

Need to know which command i can use to know how many context are running on the ASA?

Regards

Mahesh

Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 13:52:24 GMT

Hi,

Use the command "show context count"

- Jouni

Counting Context modes in ASA

mahesh18 — Tue, 02 Apr 2013 14:01:53 GMT

Hi Jouni,

When i run the command sh context i only have

config conn controller and console-output options.

No option for context

thanks

mahesh

Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 14:09:01 GMT

Hi,

You should be able to view the "show context count" command both in the System Context and Security Context configuration mode.

The command "show mode" should tell if the firewall is really in Multiple Context mode.

What ASA do you have and what software version does it have?

You should also be able to list all the context in the System Context configuration with the command "show run context"

- Jouni

Re: Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 14:11:48 GMT

According to the ASA Command Reference the only configuration mode where this command isnt usable is when the ASA is actually in Single Context Mode. In other words it isnt running Multiple Context Mode at the moment.

But the above mentioned command "show mode" should tell which mode the firewall is running on.

Here is link to the actual description of the "show context" command (ASA 8.4 version document)

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/s2.html#wp1438324

- Jouni

Counting Context modes in ASA

mahesh18 — Tue, 02 Apr 2013 14:16:50 GMT

Hi Jouni,

That ASA was running in single mode only.

When i check other ASA and run the command sh context count

it shows total active security contexts = 2

this is 5520 ASA with version 8.0.

it has no option for sh run context

thanks

mahesh

Re: Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 14:22:03 GMT

Hi,

By default the ASA models have 2 Security Context limit. They can hold 3 Security Context BUT one of them is always "admin" context which is meant for the virtual ASAs management connections.

The above output shown should mean that you have 2 Context configured of which one is "admin" and other is something that you have configured yourself. If I am not mistaken. So even if you had the default Security Context license of 2 you should still have room for one Security Context. This is because the "admin" context isnt counted towards the license limit.

You can confirm the ASAs Security Context license with "show version" command. It should list the maximum amount of Security Context the ASA can support with the current license it has.

Obviously if your ASA is running Single Mode then you can use the "show context count" command.

If the ASA is in Multiple Mode then you should be able to use the command to see how many Security Contexts has been configured.

- Jouni

Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 15:47:36 GMT

Were you able to get all the information you need?

I am not quite sure I understood the situation correctly as you are talking about different ASAs and some of them arent even using Multiple Context Mode.

- Jouni

Counting Context modes in ASA

mahesh18 — Tue, 02 Apr 2013 20:34:09 GMT

Hi jouni,

Got busy with work.

I check the current ASA which has 2 security context and one of which is admin.

on same ASA when i do sh ver

it shows security contexts as 2

so this means it has 2 security contexts that it supports including admin?

thanks

mahesh

Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 20:42:33 GMT

Hi,

So you have the default amount of Security Contexts for your ASA

To my understanding the limit of 2 means this

You can create 2 of your own Security Contexts on the ASA
The Security Context "admin" will not be counted towards this limit of 2.
So you can have "admin" context + 2 additional contexts you create yourself. The "admin" context always exists on every virtual ASA as its meant to provide management connection for the admin to all of the Security Contexts on the ASA

- Jouni

Counting Context modes in ASA

mahesh18 — Tue, 02 Apr 2013 20:54:36 GMT

Hi Jouni,

How can i check which is other security context in this ASA?

Thanks

Mahesh

Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 21:11:42 GMT

Hi,

On an ASA that is running Multiple Context Mode you should be able to just use the command "show run context" to get a listing of the Security Contexts configured on the said ASA.

You can use the command only in the System Context space

For example

ASA# show run context

If you are currently in some Security Context then you can change to the System Context with "changeto system" command.

For example

ASA/Context1# changeto system

- Jouni

Counting Context modes in ASA

mahesh18 — Tue, 02 Apr 2013 21:15:37 GMT

Hi Jouni,

I did as per your last post

on system context space i see

when i run sh run context

context admin

context b

so context b is the name of context right?

thanks for answering all my question

mahesh

Counting Context modes in ASA

Jouni Forss — Tue, 02 Apr 2013 21:21:56 GMT

Hi,

Yes, Context named "b" is one of the created contexts. The Context named "admin" is the default context in every virtual ASA used for management purposes. Though I can be used like any other context but is not really recomended usually.

- Jouni

Counting Context modes in ASA

mahesh18 — Tue, 02 Apr 2013 21:27:49 GMT

Hi Jouni,

Many thanks for answering all my questions on security context on ASA

Best Regards

Mahesh