topic Implementing Security Context in Network Security

Implementing Security Context

john.dejesus — Tue, 12 Mar 2019 00:16:01 GMT

I have a ASA 5510 and planning to implement multiple context in a 2 tier security level and vrf-lite. meaning I have 2xASA facing the internet and below that a 2x3560 switch for our extranet and below that is another 2xASA for intranet. See diagram below. In this kind of network I want to know how it would impact the total throughput and resources of the ASA using multiple context?

INTERNET

| |

2811A 2811B

| |

| | (OUTSIDE)

ASA_A-------ASA_B

| | (INSIDE)

| |

3560A---------3560B

| |

| | (INSIDE)

ASA_C--------ASA_D

| |

| | (OUTSIDE)

3560C----------3560B

| |

INTERNAL NETWORK

Implementing Security Context

Julio Carvajal — Tue, 30 Oct 2012 17:28:38 GMT

Hello John,

Pretty nice network design!

Well my first recommendation is to be aware of the features you will loose when going to multiple context, then the applicance throughput will be split into the multiple contexts. same thing with the ASA resources but you can configure this manually on each context.

As an example:

http://www.howfunky.com/2010/05/cisco-asa-resource-allocation-for.html

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html

Regards,

Julio

Implementing Security Context

john.dejesus — Wed, 31 Oct 2012 00:54:43 GMT

Hi jcarvaja,

thanks. this is the first time i will implement this kind of design. you're correct that it will split all the resources and the throughput. i want to know the best practice of configuring the resources.

Implementing Security Context

Julio Carvajal — Wed, 31 Oct 2012 01:45:40 GMT

Hello John,

Well that will depend on how many traffic will go across one specific context ( If A has more, then allocate more resouces to that one) You will be the one knowing your network and determining what is the best resoruce class configuration

Regards,