ASA · SECURITY CONTEXTS

ASA-style: three tenants in security contexts

Three tenants share one firewall, and all three use 192.168.1.0/24 inside. Security contexts make that possible: each context is a virtual firewall with its own interfaces, routes and NAT. The system execution space creates contexts and sub-interfaces and gives each context its interfaces; everything else is configured inside the context. Tenant k is on VLAN 100+k inside and VLAN 200+k outside, where R1 has 100.64.k.254.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switch · 4 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

In the system space: mode multiple, bring up Gi0/0 and Gi0/1, and create sub-interfaces Gi0/0.101 to .103 (VLANs 101 to 103) and Gi0/1.201 to .203 (VLANs 201 to 203).
Create contexts C1, C2 and C3. Give context Ck interfaces Gi0/0.10k and Gi0/1.20k, and a config-url.
In each context (changeto context Ck): inside at level 100 with 192.168.1.1/24, outside at level 0 with 100.64.k.1/24, a default route to 100.64.k.254, PAT for the inside, and inspect icmp.
Each tenant reaches 198.51.100.1, each through its own context: show xlate in C2 shows only 100.64.2.1.

Start this lab

Before you start

show context lists the contexts and their interfaces, and the prompt shows where you are (ASA1/C2#). The admin context is created for you. An interface belongs to one context; this model refuses shared interfaces, because sharing needs MAC classification.

Concept

Security contexts: many firewalls in one

In multiple context mode one firewall becomes several. The system execution space owns the hardware: it creates sub-interfaces and VLANs, creates contexts, and gives each context its interfaces. Each context then has its own interfaces, levels, routes, access rules and NAT, so tenants can use the same private addresses without ever meeting.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.