Hi,

I've been using packet-tracer for some time on and off with mixed results.

I'm running a multi context firewall with over 10 of the contexts sharing the same outside interface / network.

All interfaces obviously have valid, unique IPs and also unique MAC addresses as mac-address auto is enabled in the system context.

This is an ASA 5550 running 8.3(2.10) interim so includes the fix for the well known packet-tracer classication failed bug.

So in theory, with firewall contexts on a shared interface the ASA should use the firewall MAC address to classify incoming traffic to the correct firewall and as far as I am aware, only fall back on using NAT to classify if the interface MACs are the same. In reality on my platform this doesn't seem to be happening and the classifier is using NAT to determine the destination context. I'm seeing this with live traffic (i.e. not generated by packet-tracer) in logs and can prove it by disabling certain NAT rules (there is some overlap with the IP addressing behind each firewall).

My question regarding packet tracer is this - in the above scenario with a shared outside interface, does packet tracer ALWAYS use NAT to determine the destination context? Or does packet tracer look up the MAC address of the ingress interface according to what context you are running packet tracer from? It appears that packet-tracer is using NAT in my case which could be just symptomatic of the potential bug I've described above rather than by design.

I've trawled the forums for an answer to this and haven't found one - not sure if this is a question for TAC/Developers?

Cheers

Paul