FWSM. Sharing interfaces between contexts.

[andrea.meconi]

I’m going to configure (on paper) an FWSM with two contexts sharing inside and outside interfaces.

I’m using one context only for admin purpose (access to the system space) and other to pass traffic.

Admin and production contexts are sharing the inside and outside vlans (see attached diagram): from admin context, I need to reach some servers over vlan 940, like AAA.

I do not need to use NAT.

Now I’m reading the configuration guide about packets classification. So, because the classifier relies on active NAT sessions and for management traffic destined for an interface, the interface IP address is used for classification, I believe I need to perform NAT with some static entries on production context.

Is it wrong?

Regards.

Andrea

[Kureli Sankar]

Yes, you need to add either global or static nat so, the classifier will properly classify the flow.

If you share the outside interface, you need to provide translation for all the inside networks.

If you share the inside interfce (this is bad if it is internet facing context) you need to provide translation for all the outside hosts/network.

Even though our config guide below shows exactly what you are trying to do, it is not a good idea to do this. Troubleshooting may become a big problem.

http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/contxt_f.html#wp1124236

-KS

[andrea.meconi]

Many thanks for your help.
I understand that my problem is sharing the inside interface although I'm using admin context only for system space management.
So I can evaluate two solutions: go back to single mode or promote the production context to admin context.
Regards.
Andrea

[Kureli Sankar]

You certainly can. Make sure to save your config. Even if you do not it will be saved in the disk:

If the admin context is used only for mgmt, then you can allocate only one interface for this context. No need to allocate two. Just a thought.

-KS

[andrea.meconi]

Good. But I need to reach some servers on outside from admin.

Perhaps I can use LOCAL authentication but always I'm sharing inside.

Regards.

Andrea