topic Re: ASA Multi Context, impact of Mac Address Auto command in Network Security

ASA Multi Context, impact of Mac Address Auto command

neteng2323 — Fri, 21 Feb 2020 15:49:43 GMT

I have 2 ASAs in a active/standby failover cluster. They are running in Multi Context mode. Currently, there are no interfaces shared between contexts. All contexts have sub interfaces of a port channel allocated. However, now I have a few contexts created that will need to share interfaces and my understanding is the mac-address command is what is needed. What will be the impact of issuing the Mac Address auto command? I don't want to disrupt any of the current production contexts, and being that it's a global command it seems it may cause some unintended changes.

Re: ASA Multi Context, impact of Mac Address Auto command

Bogdan Nita — Wed, 30 May 2018 14:33:33 GMT

There is an extensive explanation of the command here:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/m1.html

, but basically it changes the way asa generates the mac addresses for its own interfaces and in case of shared interfaces you don't have to configure the macs manually.

When activated the asa should change the mac address on the interfaces, this could cause a short outage until arp will learn the new mac addresses.

HTH

Bogdan

Re: ASA Multi Context, impact of Mac Address Auto command

neteng2323 — Wed, 30 May 2018 14:52:26 GMT

Thanks for the information. I think the safe bet would be to manually configure the mac addresses per context. That way it avoids any unintended changes.