Cascading Security Contexts - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 3 Enabling Multiple Context Mode
Security Context Overview
For transparent firewalls, you must use unique interfaces. Figure 3-4 shows a host on the Context B
inside network accessing the Internet. The classifier assigns the packet to Context B because the ingress
interface is Gigabit Ethernet 1/0.3, which is assigned to Context B.
Figure 3-4 Transparent Firewall Contexts
Internet
Classifier
GE 0/0.2
GE 0/0.1 GE 0/0.3
Admin
Context A Context B
Context
GE 1/0.1 GE 1/0.2 GE 1/0.3
Inside
Admin Inside
Customer B
Network Customer A
Host Host Host
10.1.1.13 10.1.2.13 10.1.3.13

Cascading Security Contexts

Placing a context directly in front of another context is called cascading contexts; the outside interface
of one context is the same interface as the inside interface of another context. You might want to cascade
contexts if you want to simplify the configuration of some contexts by configuring shared parameters in
the top context.
Cascading contexts requires that you configure unique MAC addresses for each context interface.
Note
Because of the limitations of classifying packets on shared interfaces without MAC addresses, we do not
recommend using cascading contexts without unique MAC addresses.
Cisco Security Appliance Command Line Configuration Guide
3-8
OL-10088-01