08-12-2013 04:32 PM - edited 03-11-2019 07:24 PM
Hi Everyone,
Need to confirm below is the right way to make changes in firewall when they are in multi context mode--Active ,Active
Need to add ACL in 2 firewalls.
Say ASA1 has two contexts admin and a
When i logon to say IP 192.168.1.1 i go to ASA1/admin which is primary ASA and active for context admin.
Context a is standby here.
Here i added the ACL rule under the admin context of ASA1.
Now i log onto second say hostname ASA1
Here say i log onto IP 192..168.1.2 go to ASA/admin which is seconday ASA and admin context is standby here
Context a is active here.
From admin context i will go to context a and get hostname ASA1/aand will add the ACL rule here.
after the above change is done new rule should show up in both the contexts of primary and secondary fws and right?
Best regards
Mahesh
Message was edited by: mahesh parmar
Solved! Go to Solution.
08-12-2013 04:41 PM
Hi Mahesh,
So if you have Active/Active ASA pair and several Security Contexts in them then there is really nothing that different from configuring those Security Context compared to configuring an Active/Standby pair.
You basically find/determine the device that is Active for the Security Context you want to configure, log into that device and go into the Security Context and make the required configurations and they will be automatically replicated to the other physical units Standby Security Context.
You should get a warning before configuring anything if you happen to be logged on a unit that is in Standby State
To my understanding as soon as you enter
configure terminal (or conf t)
The ASA will notify you that you are configuring the Standby unit and the commands you will enter wont be replicated to the other unit that is Active for this Context at the moment.
Basically the easiest command to determine the roles of each ASA device for specific Security Context is to use the following command
show failover
When you use it in the System Context space/mode I think you should get listing of that devices State for ALL of the Security Contexts configured on that device.
- Jouni
08-12-2013 04:41 PM
Hi Mahesh,
So if you have Active/Active ASA pair and several Security Contexts in them then there is really nothing that different from configuring those Security Context compared to configuring an Active/Standby pair.
You basically find/determine the device that is Active for the Security Context you want to configure, log into that device and go into the Security Context and make the required configurations and they will be automatically replicated to the other physical units Standby Security Context.
You should get a warning before configuring anything if you happen to be logged on a unit that is in Standby State
To my understanding as soon as you enter
configure terminal (or conf t)
The ASA will notify you that you are configuring the Standby unit and the commands you will enter wont be replicated to the other unit that is Active for this Context at the moment.
Basically the easiest command to determine the roles of each ASA device for specific Security Context is to use the following command
show failover
When you use it in the System Context space/mode I think you should get listing of that devices State for ALL of the Security Contexts configured on that device.
- Jouni
08-12-2013 06:42 PM
Hi Jouni,
Thanks for prompt reply.
Best Regards
Mahesh
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide