Can we have separate physical interfaces for management in multi context.

[Ramakrishnan G.]

Can anyone suggest on the below.

I've a special requirement of implementing a separate physical interface for management on the newly added contexts. I understand we can allocate the same physical interface(which is connected to an access port) to multiple context or we can assign the sub-interfaces(which is connected to a trunk port) of same physical link to multiple contexts for management.  But is it possible to have 2 separate physical links in ASA for management and these two interfaces will be used in two different contexts.

Or in other words can I use two separate physical links in ASA for firewall management. One for admin context management and one for another context.

Regards,

Kris

[Vibhor Amrodia · Accepted solution]

Hi,

Let me clarify , Management interface on the ASA device is a normal DATA interface which is specifically used to manage the ASA device possibly via SSH , TELNET, ASDM etc.

I think for these functions you can assign any interface to that context and enable these features for managing the ASA device.

Does that clear your query ?

Thanks and Regards,

Vibhor Amrodia

[Ramakrishnan G.]

Thanks Vibhor for your response. So the conclusion is there's no such limitations in ASA for configuring multiple physical interfaces as management 

[Vibhor Amrodia]

Hi,

Yes , there is no such restriction.

Thanks and Regards,

Vibhor Amrodia

[Marius Gunnerud · Accepted solution]

But is it possible to have 2 separate physical links in ASA for management and these two interfaces will be used in two different contexts.

Yes, you would just need to allocate the physical interfaces to the contexts under the system context.  Just keep in mind that when you log in to the admin context you will be able to switch between different contexts by using the changeto context command. However, if you login to a different context directly you will be restricted to only that context and will not be able to change to another context from that context.

Any interface on the ASA can be used for management of the ASA so long as it has network connectivity.

--

Please remember to select a correct answer and rate helpful posts

[Ramakrishnan G.]

Thanks Marius,

I was in an assumption that when we migrate the existing management interface of an admin context to a separate physical interface it throw up some error. I don't have a lab to test it. 

[Marius Gunnerud]

are you talking about using a normal routed interface for management access? or using the command management-only on an interface?  Either way you can use any interface that has network connectivity for management access, and you can configure as many interfaces as you want with the management-only command.  just keep in mind that interfaces with the management-only command configured will not pass normal data traffic.

--

Please remember to select a correct answer and rate helpful posts