Objectives
The simulator ticks each one as soon as the network meets it.
show context: eleven contexts (the admin context and C1 to C10), each tenant with two sub-interfaces.
Configure contexts C8, C9 and C10 the way C1 is: inside, outside, a default route, PAT and inspect icmp.
All ten tenants reach 198.51.100.1, each from its own outside address (100.64.k.1).
The tenants stay apart: each context’s show xlate holds only its own tenant.
Before you start
Copy C1’s configuration (changeto context C1, show running-config) and change the VLAN numbers and addresses. A context can’t see another context’s interfaces at all, so overlapping addresses never meet.
Concept
Security contexts: many firewalls in one
In multiple context mode one firewall becomes several. The system execution space owns the hardware: it creates sub-interfaces and VLANs, creates contexts, and gives each context its interfaces. Each context then has its own interfaces, levels, routes, access rules and NAT, so tenants can use the same private addresses without ever meeting.
Concept
Firewall NAT: three sections, applied in order
An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.
