topic Re: Context FW 'mac-address auto' in Network Security

Context FW 'mac-address auto'

johnlloyd_13 — Fri, 21 Feb 2020 16:51:26 GMT

hi,

i'm going to configure a multiple context FW on a new ASA5525-X.

i saw previous setup with and without the 'mac-address auto' command under the system context.

my question is, is the command required or optional?

if not enabled, will this cause 'asymmetric' routing issue towards a specific context?

Re: Context FW 'mac-address auto'

Mohammed al Baqari — Mon, 25 Feb 2019 06:52:26 GMT

It can work with and without this command.

By default, contexts sharing same interface will have the same mac address
for the interface in each context which is the mac of the physical
interface. When the packets forwarded from the upstream device to the
multi-context firewall, the firewall will use the destination IP address to
identify the right context because all contexts share the same destination
mac (For the shared interface). To get destination IP used, you need to
configure NAT rules for that destination address (unity NAT or identity
NAT). This method has other limitations.

With this command, each presence of the share interface per context will
have a uniquely generated MAC address started with A2.

In you don't share any interface between contexts then you don't have
problems and this command isn't needed. However, if you have shared
interfaces the best practice is to enable this command.

Re: Context FW 'mac-address auto'

Sheraz.Salim — Mon, 25 Feb 2019 07:45:52 GMT

From version 9.3 this command is enable auto so you don’t have to config this.

If you using nat on the box it will use the nat sequence number to create a sessions