×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Outside interface on Multiple context ASA

Answered Question
Jul 1st, 2013
User Badges:

Hi Everyone,


Need to confirm below


If we have ASA in multi context mode and it has only single interface say gi2 that is shared between 2 contexts and its subinterfaces have different

IP address then we can confirm that this is the outside interface of the ASA as a whole?


Regards

Mahesh

Correct Answer by Jouni Forss about 4 years 1 month ago

Hi,


Well it depends.


I think by default the ASA is set to have same MAC address for each subinterface of a single physical interface.


To my understanding this is changed by setting the "mac-address auto" in the System Context configuration after which the ASA generates MAC addresses for the interfaces. The default setting is, as I said, "no mac-address auto".


Or you can even set the interfaces MAC address under the interface configuration mode.


Here is a link to a command reference which explains the command use


http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/m.html#wp2043127


- Jouni

Correct Answer by Jouni Forss about 4 years 1 month ago

Hi,


If the ASA only is connected through the physical interface Gi0/2 to the next device and its divided into subinterfaces then it would seem that one of those interfaces is used for outside connectivity.


Judging by what you say the ASA has a single Trunk link to some neighbor device and subinterfaces are used to handle "inside" , "dmz" , "outside" and all other kinds of interfaces for the actual Security Contexts.


Without seeing any configurations I dont know if there is anything else that can be said of the setup.


- Jouni

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
Jouni Forss Mon, 07/01/2013 - 09:27
User Badges:
  • Super Bronze, 10000 points or more

Hi,


If the ASA only is connected through the physical interface Gi0/2 to the next device and its divided into subinterfaces then it would seem that one of those interfaces is used for outside connectivity.


Judging by what you say the ASA has a single Trunk link to some neighbor device and subinterfaces are used to handle "inside" , "dmz" , "outside" and all other kinds of interfaces for the actual Security Contexts.


Without seeing any configurations I dont know if there is anything else that can be said of the setup.


- Jouni

mahesh18 Mon, 07/01/2013 - 10:03
User Badges:

Hi Jouni,


For current setup seems gi0/2 is outside int of ASA.

Also the shared interface which is Gi0/2  has different mac address for each context i mean to say


context admin


int gi0/2.3  has say mac of 1234


context x 


int gi0/2.5  has say mac of 6789


So this is default behaviour?


Regards


MAhesh

Correct Answer
Jouni Forss Mon, 07/01/2013 - 11:37
User Badges:
  • Super Bronze, 10000 points or more

Hi,


Well it depends.


I think by default the ASA is set to have same MAC address for each subinterface of a single physical interface.


To my understanding this is changed by setting the "mac-address auto" in the System Context configuration after which the ASA generates MAC addresses for the interfaces. The default setting is, as I said, "no mac-address auto".


Or you can even set the interfaces MAC address under the interface configuration mode.


Here is a link to a command reference which explains the command use


http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/m.html#wp2043127


- Jouni

Actions

This Discussion