Hi,
In the old FWSM enviroment I think we ran into some problems when there needed to be traffic between the Contexts through the "outside" interface. Dont exactly remember what the situation was since it was such a long time ago.
On the ASA side we use separate subinterface for each context but on the core side they are still part of the same subnet. (with the actual IP addresses under a loopback interface and subinterfaces using "ip unnumbered loopbackx" configuration.)
Our decision to use separate subinterfaces for each context on the core side is to be able to create different policys for each "outside" interface. (Not on the ASA but on the core device where the ASA is connected to)
I guess in our amount of Contexts it also beneficial to have separate subinterfaces to easily pinpoint the Context which owns a particular IP address as we can determine it by the subinterfaces easily while on the FWSM side it was a bit of a pain with a shared "outside" Vlan interface.
- Jouni
