topic Re: firewall contexts in Network Security

firewall contexts

suthomas1 — Mon, 11 Mar 2019 17:03:38 GMT

Gurus,

We have a requirement to create 2 contexts & 1 admin context on a HA based ASA. The local ip range i have is 192.168.100.0 /24.

Internet traffic will be coming on to this context, although there will be only one single internet line and not two different ones for each context.

Please help me as to how the ip assignments on these contexts must be made wrt to HA pair.A brief overall config including ip address would be very much appreciated.

Thank You.

Re: firewall contexts

suthomas1 — Sun, 31 Jan 2010 07:25:24 GMT

(EDIT): these also need to have a DMZ interface on each of them. How is that also be incorporated in this.

Thanks.

Re: firewall contexts

Kureli Sankar — Sun, 31 Jan 2010 17:50:41 GMT

Pls. see an example here:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/examples.html#wp1009684

-KS

Re: firewall contexts

suthomas1 — Mon, 01 Feb 2010 15:51:41 GMT

Thanks for the great link. Another query though, since the firewall is in an HA mode, how do we allocate public ip address on its internet facing interface.

viz, would the admin context also need to be put in with ip address or is it only for the other 3 contexts interface. If so, would each context on active firewall have different public ip address and would same apply to standby firewall.

Appreciate any assistance!

Re: firewall contexts

Kureli Sankar — Mon, 01 Feb 2010 16:31:41 GMT

Good question. We do recommend to add a standby IP for all interfaces. If you have available addresses I would add a standby IP address for the outside interface for all the contexts. Otherwise you can leave it just with the active IP. Failover will still work. Just monitoring interface will not work.

When you issue sh fail, active unit will show up with an IP address but the standby unit will show up as 0.0.0.0. That is all.

-KS

Re: firewall contexts

suthomas1 — Mon, 01 Feb 2010 17:17:58 GMT

thanks for the prompt help. to make it more easily digestible to me, below is the
sample config i have done to enact this scenario:

each context will have a different organisation on it.

FWA(Active) - Context 1 & Context 2
FWB(Standby) - Context 1 & Context 2

Assuming public ip's to be 192.168.100.4 /29

Gw: 192.168.100.5

On FWA- context1: i assign IP 192.168.100.6 /29 on public interface
On FWA- context2: i assign IP 192.168.100.7 /29 on public interface

(Or does it mean that Context2 doesnt have to be assigned any ip or the same as Context1) ?

On FWB- context1: Unassigned
On FWB- context2: Unassigned

Is this correct as per my understanding of your post.

Tons of thanks to you!

Re: firewall contexts

Kureli Sankar — Mon, 01 Feb 2010 17:22:19 GMT

That is correct. You did understand it correct.

-KS

Re: firewall contexts

suthomas1 — Mon, 01 Feb 2010 17:32:22 GMT

Ok. that means Context1 & Context2 will have seperate translation tables ?

Thanks.

Re: firewall contexts

Kureli Sankar — Mon, 01 Feb 2010 17:39:21 GMT

Yes that is correct. Context 1 and context 2 are two different firewalls.

-KS