ing Contexts The Classifier When there are multiple contexts sharing physical interfaces, there must be some way for the ASA to decide which context should receive a packet. This job is delegated to a process called the classifier. The classifier is an important aspect of a multicontext ASA, and its operation and lim- itations must be understood. Failure to understand the classifier's operation will lead to heartache, depression, and perhaps most importantly, an ASA that won't work. There are multiple ways in which contexts can be created, all of which have different limitations and configuration requirements due to how the classifier works. No shared interfaces The simplest design for a multicontext ASA is shown in Figure 28-5. In this figure, there are three contexts. Each context has a separate inside and outside interface. Each in- terface is physically allocated to only one context. In this design, each interface can be a VLAN-tagged subinterface, which is different than sharing an interface. When each context has its own interfaces, there is no interaction between contexts. It is truly as if each context were a standalone firewall. This is the simplest of multicontext designs, and no special consideration needs to given to how interfaces are addressed. VLAN 50 VLAN 60 VLAN 70 Single Multicontext Firewall Context 2 Context 3 Context 4 VLAN 100 VLAN 200 VLAN 300 Figure 28-5. Multiple contexts with no shared interfaces Another way to view such a design is shown in Figure 28-6. Again, no network or interface is shared between the contexts. Shared outside interfaces With multiple contexts, it is possible to share an interface between contexts, as shown in Figure 28-7. In this case, interface G0/0 is assigned to all three contexts. Here, each context has an IP address within the same network (hopefully), and they all have the same default gateway. Chapter 28: ASA Firewall Configuration Context 3 Figure 28-6. Another no-shared-interface multicontext scenario VLAN 50 Single Multicontext Firewall Context 2 Context 3