PIX 515 and higher and ASA 5510 and higher support contexts.
- active/active failover
- ISP, co-location/hosting companies that host services requiring firewall functions
- Need more than one firewall in the same physical location.
- Dynamic routing protocols (unicast & multicast) are unsupported, only static routes available.
- No VPN support, no matter IPSec, L2TP or WebVPN.
- Threat detection is unsupported.
- system-wide configuration
- create/delete contexts
- doesn’t count as a context itself.
- accessed by admin context.
- leverage admin context to communicate with external devices/services.
- Have a name, interfaces allocated to it and a configuration file to store the security policies and configuration of actual context itself.
- By default, ‘admin’ context is the administrative context to access system area.
- Any context can be admin context, but just only one. (admin-context context_name)
- Context can be chained by sharing a common physical/vlan interface.
- Only MAC address and translation rules are used to match a packet to a context when interfaces are shared.
- Recommend to assign unique MAC for interface of each context. (mac-address auto)
Following resources can be defined(limited) for a context.
- Mgmt connections: ASDM, telnet & ssh.
- MAC addresses
- Xlates in the translation table.
- Connectoins in the state table.
- Syslog messages/second.
- Applicaton inspections/second.