ASA basics

[Maro.Cisco]

                  Dears please correct me if im wrong , i have a question by default when im configuring ASA , i'll have only 1 exit interface , 1 internal , 1 DMZ and will apply my policies to this interfaces however if i need to apply different external , internal and DMZ policies i'll have to use security context which basically split my ASA into two different firewall system and i have the ability to either use the same interface i used on context1 or chooose other interfaces???

[Jouni Forss]

Hi,

I am not sure what you mean by policies. If you simply mean "access-list" that control traffic then you can naturally configure ACLs for each interface separately.

You would typically virtualize the ASA to Multiple Context mode when you want to "completely" separate the 2 LAN/DMZ networks. In this case you could naturally share the same "outside" interface on both Security Context if you wanted. Naturally if you have a small public subnet the choice would probably be to share the "outside" interface

- Jouni

[Maro.Cisco]

what i mean that if you have configured on ASA ICMP inspection then all ICMP traffic coming  on your  interfaces will be allowed lets say your attaching this new LAN to your ASA and you dont want to enable ICMP inspection then this when u will use context first to have a seperate firewall for this new lan and where you can apply what type of packets you want to inspect ????

[Jouni Forss]

Hi,

Even if you use the ASAs default global inspection policy for all the ASA interfaces then you still naturally have the option to block the ICMP in an interface ACL. You can simply build an ACL to the new interface on the ASA that blocks the ICMP traffic.

Even though I have never done so, I guess you could always remove the default inspection policy that is attached globally and configure a separate policy for each interface and configure them in different ways.

But if you only goal is to limit traffic from a new interface on the ASA then you could naturally just use interface ACLs to block the traffic you need and allow the traffic you need.

- Jouni

[Maro.Cisco]

so basically i'll only need to use mutliple context if i need to seperate the new LANS , as if each is connected to seperate firewall , but if im not using mutlicontext i shouldnt find anyyyyyyy limitations with controlling my traffic

[Jouni Forss · Accepted solution]

Hi,

Yes, usually if you want to keep certain networks apart from eachother then you would configure ASA in Multiple Context mode. For example in my work I constantly deal with virtualized ASAs since I work for an ISP.

Sometimes I guess configuring Multiple Context mode might be needed because you have some overlapping networks which naturally cant be really used with a single ASA.

A key thing to notice with Multiple Context mode ASAs is usually the fact that you will loose the ability to configure VPN client connections of any type on that ASA. Thats a deal breaker for some. Naturally you can always host VPN services on a separate device if needed also.

You should be able to control traffic on a single ASA with ACLs attached to each interface. Even if you had for example global inspection enabled for ICMP and FTP, you could still simply block those connections from behind a single interface if you wanted. The "inspect" commands wont affect what traffic is allowed if the ACL is already defined to block that traffic.

- Jouni

[Maro.Cisco]

Thank you , you were great help.