ASA · BUDDY SDM

Buddy SDM Manager: two tenants on one firewall

Two tenants share this firewall, and both use 10.0.0.0/24 inside. A single firewall could not tell them apart, but two contexts can. Create the contexts on the Contexts screen, then choose each one at the top of the page: every other screen then shows that context alone.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switch · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Contexts screen: switch ASA1 to multiple context mode.
Create context TENA with Gi0/0 and Gi0/2, and context TENB with Gi0/1 and Gi0/3.
Choose TENA. Interfaces: inside on Gi0/0 (level 100, 10.0.0.1/24), outside on Gi0/2 (level 0, 192.0.2.1/24). A default route to 192.0.2.254. NAT: hide 10.0.0.0/24 behind outside with object INSIDE, and turn on Inspect ICMP.
Choose TENB. The same, with inside on Gi0/1 and outside on Gi0/3 at 192.0.2.2/24.
T1 and T2 both reach 198.18.0.1, though they have the same address.

Start this lab

Before you start

The system space owns contexts and physical ports; a context owns names, addresses, routes and NAT. So the forms on each screen change with where you are, and the prompt in the console shows it (ASA1/TENA#). An interface belongs to one context at a time.

Concept

A firewall GUI is the CLI with a form in front

A manager screen does not change the firewall by itself. It turns your form into CLI lines, shows them to you, and sends them through the same session as the console. So the screens and the console always agree, and every change is a command you can read, repeat and type yourself. The logs then show both sides: what you told the firewall, and what it did with traffic.

Concept

Security contexts: many firewalls in one

In multiple context mode one firewall becomes several. The system execution space owns the hardware: it creates sub-interfaces and VLANs, creates contexts, and gives each context its interfaces. Each context then has its own interfaces, levels, routes, access rules and NAT, so tenants can use the same private addresses without ever meeting.