Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

How to create multiple contexts in FWSM

I have an FWSM on 6509 and want to create two contexts sharing interfaces. I am able to do this for "Outside" interface for which inside to outside static NAT exists. But if I create second context for "Management" interface, connectivity from server in management interface to other interfaces in first context is lost.

I have tried Global and Static NAT also for inside to Management in second context, but it is not working.

Does anybody have any idea, what may be the cause of this problem?



Re: How to create multiple contexts in FWSM

The link at the bottom of my post might be useful. It explains the logic used by the FWSM when multiple contexts share the same interface. Basically, the fwsm looks at the destination and checks for a NAT. If there isn't one, it doesn't know what to do with the packet.

In your case, if your management network has to get to the Internet, you would have a problem. Say server sent a packet to context 1 destined for on the internet. The FWSM would receive it and look for a translation for to decide which context it belongs to. Unless you want to static NAT all IPs on the Internet, you will have a challenge.

Now if you don't care about Internet access from the management segment, you can set up statics for the management interface on each context. So for example, say management is, inside of context 1 is, and inside on context 2 is You could just set up:

!context 1

static (inside,management) netmask

!context 2

static (inside,management) netmask

This way any traffic from the management interface destined to 10.10.10.x would accurately go to context 1, and 10.20.20.x would be sent to context 2.

Hopefully this makes sense.


New Member

Re: How to create multiple contexts in FWSM

Thanks eric for the reply. I am still facing the problem as described under.

I have created two contexts ContextA and ContextB. Each is having VLAN100 for Outside with IPs and respectively. Now I create an interface with name Management with VLAN 200 in ContextA with IP and a static statement as under

static (management,outside) netmask

where is a server in Management VLAN

It works fine, means I am able to access its resources from Outside. But as soon as I create the Management interface in ContextB with IP, Outside stops communicating with both the contexts.

I tried creating a STATIC NAT as under:

static (management,outside) netmask

But that also not helps.

This way I am not able to share the management interface between two contexts.

Need help from somebody