Adding ACL in Multicontext Firewall

[mahesh18]

Hi Everyone,

Need to confirm below is the right way to make changes in firewall when they are in multi context mode--Active ,Active

Need to add ACL in 2 firewalls.

Say ASA1 has two contexts admin and a

When i logon to say IP 192.168.1.1  i go to ASA1/admin  which is primary ASA  and active for context admin.

Context a is standby here.

Here i added the ACL  rule under the admin context  of ASA1.

Now i log onto second say hostname ASA1

Here say i log onto IP 192..168.1.2 go to ASA/admin which is seconday ASA  and admin context is standby here

Context  a is active here.

From admin context i will go to context a and get hostname ASA1/aand will add the ACL rule here.

after the above change is done new rule should show up in both the contexts of  primary and secondary fws and right?

Best regards

Mahesh

Message was edited by: mahesh parmar

[Jouni Forss · Accepted solution]

Hi Mahesh,

So if you have Active/Active ASA pair and several Security Contexts in them then there is really nothing that different from configuring those Security Context compared to configuring an Active/Standby pair.

You basically find/determine the device that is Active for the Security Context you want to configure, log into that device and go into the Security Context and make the required configurations and they will be automatically replicated to the other physical units Standby Security Context.

You should get a warning before configuring anything if you happen to be logged on a unit that is in Standby State

To my understanding as soon as you enter

configure terminal (or conf t)

The ASA will notify you that you are configuring the Standby unit and the commands you will enter wont be replicated to the other unit that is Active for this Context at the moment.

Basically the easiest command to determine the roles of each ASA device for specific Security Context is to use the following command

show failover

When you use it in the System Context space/mode I think you should get listing of that devices State for ALL of the Security Contexts configured on that device.

- Jouni

[mahesh18]

      Hi Jouni,

Thanks for prompt reply.

Best Regards

Mahesh