ASA Multiple context sharing Outside interface

[mahesh18]

Hi All,

I have question regarding the ASA  when working as multiple context mode.

If output interface is shared by two contexts and both  have different IP  address.

Is it possible that outside shared interface can have same mac address for both the contexts?

Will the Setup work if outside interface is shared and also configured  with same mac address?

Second Setup

If outside interface is shared but has unique mac address and connection is initated from the internet will then traffic  reach the inside context of

ASA?

Regards

Mahesh

[Jouni Forss · Accepted solution]

Hi Mahesh,

I think by default when you configure the ASA in Multiple Context mode and have a shared interface between 2 Security Contexts then both of the interfaces will use the same MAC address.

In those cases I assume that the ASA uses existing NAT configurations or IP addresses configured on the ASA interfaces to determine which is the correct Security Content to which the traffic needs to be forwarded to.

It should work as long as the IP address configured on the interface is different. Naturally if the NAT configurations also play a role as I said.

With regards to the second setup. I would imagine that this is actually the preferred way. That each contexts shared interface has a unique MAC address.

You can check this section of the 8.2 configuration guide

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146806

- Jouni

[mahesh18]

Hi Jouni,

Many thanks again.

Regards

MAhesh