Counting Context modes in ASA

[mahesh18]

                   Hi Everyone,

We have ASA  that are running multiple context mode.

Need to know which command i can use to know how many context are running on the ASA?

Regards

Mahesh

[Jouni Forss]

Hi,

Use the command "show context count"

- Jouni

[mahesh18]

Hi Jouni,

When i run the command sh context i only have

config conn controller and console-output options.

No option for context

thanks

mahesh

[Jouni Forss · Accepted solution]

Hi,

You should be able to view the "show context count" command both in the System Context and Security Context configuration mode.

The command "show mode" should tell if the firewall is really in Multiple Context mode.

What ASA do you have and what software version does it have?

You should also be able to list all the context in the System Context configuration with the command "show run context"

- Jouni

[Jouni Forss · Accepted solution]

According to the ASA Command Reference the only configuration mode where this command isnt usable is when the ASA is actually in Single Context Mode. In other words it isnt running Multiple Context Mode at the moment.

But the above mentioned command "show mode" should tell which mode the firewall is running on.

Here is link to the actual description of the "show context" command (ASA 8.4 version document)

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/s2.html#wp1438324

- Jouni

[mahesh18]

Hi Jouni,

That ASA  was running in single mode only.

When i check other ASA  and run the command sh context count

it shows total active security contexts = 2

this is 5520 ASA  with version 8.0.

it has no option for sh run context

thanks

mahesh

[Jouni Forss · Accepted solution]

Hi,

By default the ASA models have 2 Security Context limit. They can hold 3 Security Context BUT one of them is always "admin" context which is meant for the virtual ASAs management connections.

The above output shown should mean that you have 2 Context configured of which one is "admin" and other is something that you have configured yourself. If I am not mistaken. So even if you had the default Security Context license of 2 you should still have room for one Security Context. This is because the "admin" context isnt counted towards the license limit.

You can confirm the ASAs Security Context license with "show version" command. It should list the maximum amount of Security Context the ASA can support with the current license it has.

Obviously if your ASA is running Single Mode then you can use the "show context count" command.

If the ASA is in Multiple Mode then you should be able to use the command to see how many Security Contexts has been configured.

- Jouni

[Jouni Forss · Accepted solution]

Were you able to get all the information you need?

I am not quite sure I understood the situation correctly as you are talking about different ASAs and some of them arent even using Multiple Context Mode.

- Jouni

[mahesh18]

Hi jouni,

Got busy with work.

I check the current ASA  which has 2 security context and one of which is admin.

on same ASA  when i do sh ver

it shows security contexts  as 2

so this means it has 2 security contexts that it supports including admin?

thanks

mahesh

[Jouni Forss · Accepted solution]

Hi,

So you have the default amount of Security Contexts for your ASA

To my understanding the limit of 2 means this

• You can create 2 of your own Security Contexts on the ASA
• The Security Context "admin" will not be counted towards this limit of 2.
• So you can have "admin" context + 2 additional contexts you create yourself. The "admin" context always exists on every virtual ASA as its meant to provide management connection for the admin to all of the Security Contexts on the ASA

- Jouni

[mahesh18]

Hi Jouni,

How can i check which is other security context  in this ASA?

Thanks

Mahesh

[Jouni Forss · Accepted solution]

Hi,

On an ASA that is running Multiple Context Mode you should be able to just use the command "show run context" to get a listing of the Security Contexts configured on the said ASA.

You can use the command only in the System Context space

For example

ASA# show run context

If you are currently in some Security Context then you can change to the System Context with "changeto system" command.

For example

ASA/Context1# changeto system

- Jouni

[mahesh18]

Hi Jouni,

I did as per your last post

on system context space i see

when i run sh run context

context admin

context b

so context b is the name of context right?

thanks for answering all my question

mahesh

[Jouni Forss · Accepted solution]

Hi,

Yes, Context named "b" is one of the created contexts. The Context named "admin" is the default context in every virtual ASA used for management purposes. Though I can be used like any other context but is not really recomended usually.

- Jouni

[mahesh18]

Hi Jouni,

Many thanks for answering all my questions on security context on ASA

Best Regards

Mahesh