Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

pix 8.0 security context

Hi

i want to have two security context for active/active failover. but I have a problem with the admin context

I want the context 1 to be empty and the context 2 to contient one gateway(on outside interface) and several vlans.

The context2 will be part of the failover group2 wich willbe active on security appliance2.

the context 1 will be part of the failover group1 wich will be active on security appliance1.

But wath do I do with the admin context? wath do I put or remove from this context? does it have to contains all the interfaces?

I have 802.1Q trunks for  both, outside & inside interfaces

I want  vlan2, vlan3, vlan4,vlan5 in the inside & vlan 10, vlan 11 in the outside

Security appliance1 would have:

context context1
  allocate-interface GigabitEthernet0.10 outside_context1
  allocate-interface GigabitEthernet1.2 vlan2

  allocate-interface GigabitEthernet1.3 vlan3

  config-url flash:/context1.cfg

context context2

  config-url flash:/context2.cfg

Security appliance2 would have:

context context1

  config-url flash:/context1.cfg

context context2
   allocate-interface GigabitEthernet0.11 outside_context1
   allocate-interface GigabitEthernet1.4 vlan4

  allocate-interface GigabitEthernet1.5 vlan5

  config-url flash:/context2.cfg

Wath about context admin wath do I out or wath doit remove?

Actually it has everithing:

context admin

  allocate-interface GigabitEthernet0.10

  allocate-interface GigabitEthernet0.11

  allocate-interface GigabitEthernet1.2

  allocate-interface GigabitEthernet1.3

  allocate-interface GigabitEthernet1.4

  allocate-interface GigabitEthernet1.5

  config-url flash:/admin.cfg

Thanks you very much

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: pix 8.0 security context

roussillon wrote:

Hi

i want to have two security context for active/active failover. but I have a problem with the admin context

I want the context 1 to be empty and the context 2 to contient one gateway(on outside interface) and several vlans.

The context2 will be part of the failover group2 wich willbe active on security appliance2.

the context 1 will be part of the failover group1 wich will be active on security appliance1.

But wath do I do with the admin context? wath do I put or remove from this context? does it have to contains all the interfaces?

I have 802.1Q trunks for  both, outside & inside interfaces

I want  vlan2, vlan3, vlan4,vlan5 in the inside & vlan 10, vlan 11 in the outside

Security appliance1 would have:

context context1
  allocate-interface GigabitEthernet0.10 outside_context1
  allocate-interface GigabitEthernet1.2 vlan2

  allocate-interface GigabitEthernet1.3 vlan3

  config-url flash:/context1.cfg

context context2

  config-url flash:/context2.cfg

Security appliance2 would have:

context context1

  config-url flash:/context1.cfg

context context2
   allocate-interface GigabitEthernet0.11 outside_context1
   allocate-interface GigabitEthernet1.4 vlan4

  allocate-interface GigabitEthernet1.5 vlan5

  config-url flash:/context2.cfg

Wath about context admin wath do I out or wath doit remove?

Actually it has everithing:

context admin

  allocate-interface GigabitEthernet0.10

  allocate-interface GigabitEthernet0.11

  allocate-interface GigabitEthernet1.2

  allocate-interface GigabitEthernet1.3

  allocate-interface GigabitEthernet1.4

  allocate-interface GigabitEthernet1.5

  config-url flash:/admin.cfg

Thanks you very much

The admin context is used purely for administering the ASA so it doesn't need to have all the interfaces in it. It should have it's own interfaces that ar used purely to remotely logon to the ASA and also for remotely accessing config files etc.

Jon

2 REPLIES
Hall of Fame Super Blue

Re: pix 8.0 security context

roussillon wrote:

Hi

i want to have two security context for active/active failover. but I have a problem with the admin context

I want the context 1 to be empty and the context 2 to contient one gateway(on outside interface) and several vlans.

The context2 will be part of the failover group2 wich willbe active on security appliance2.

the context 1 will be part of the failover group1 wich will be active on security appliance1.

But wath do I do with the admin context? wath do I put or remove from this context? does it have to contains all the interfaces?

I have 802.1Q trunks for  both, outside & inside interfaces

I want  vlan2, vlan3, vlan4,vlan5 in the inside & vlan 10, vlan 11 in the outside

Security appliance1 would have:

context context1
  allocate-interface GigabitEthernet0.10 outside_context1
  allocate-interface GigabitEthernet1.2 vlan2

  allocate-interface GigabitEthernet1.3 vlan3

  config-url flash:/context1.cfg

context context2

  config-url flash:/context2.cfg

Security appliance2 would have:

context context1

  config-url flash:/context1.cfg

context context2
   allocate-interface GigabitEthernet0.11 outside_context1
   allocate-interface GigabitEthernet1.4 vlan4

  allocate-interface GigabitEthernet1.5 vlan5

  config-url flash:/context2.cfg

Wath about context admin wath do I out or wath doit remove?

Actually it has everithing:

context admin

  allocate-interface GigabitEthernet0.10

  allocate-interface GigabitEthernet0.11

  allocate-interface GigabitEthernet1.2

  allocate-interface GigabitEthernet1.3

  allocate-interface GigabitEthernet1.4

  allocate-interface GigabitEthernet1.5

  config-url flash:/admin.cfg

Thanks you very much

The admin context is used purely for administering the ASA so it doesn't need to have all the interfaces in it. It should have it's own interfaces that ar used purely to remotely logon to the ASA and also for remotely accessing config files etc.

Jon

Community Member

Re: pix 8.0 security context

yes it worked, Thank.

but  I can not make ping & traceroute work

I added

access-list outside_access_in extended permit icmp any any time-exceeded log disable 
access-list outside_access_in extended permit icmp any any echo-reply log disable

access-group outside_access_in in interface outside

It works fine in single mode but it seems to have no effect in context mode

is there something missing?

Thanks
204
Views
0
Helpful
2
Replies
CreatePlease to create content