 Context 4 VLAN 100 VLAN 200 VLAN 300 Figure 28-7. Multiple contexts with shared outside interface A design like this might be popular in an ISP environment where multiple firewalls share a single outside public IP network on a single VLAN. This design is relatively simple for the classifier to understand, because the default gateway is usually on the outside interface. Packets with an unknown destination will be forwarded outbound to the default gateway, which will likely be the same on every context. Inbound packets will be forwarded to the next-hop IP by the default gateway router, but each of these different IP addresses will (by default) have the same MAC address. The classifier will figure out to which context the packet should be sent based on the destination IP address. The destination IP address will either be a NAT address within a context or known within the routing table of a context. Managing Contexts A better way to configure this scenario is to enable unique MAC addresses per context. This will allow the outside router (default gateway) to forward directly to the proper context without the classifier being involved. Shared inside interface Another way that interfaces can be shared is shown in Figure 28-8. This is the opposite of the previous example (Figure 28-7). Here, though the outside interfaces are discrete, the inside interfaces all share an interface: VLAN 100 VLAN 200 VLAN 300 Single Multicontext Firewall Context 2 Context 3 Context 4 VLAN 50 Figure 28-8. Multiple contexts sharing the inside interface This design, while technically possible, is not recommended, especially on Internet- facing firewalls. The reason for this has to do with the way that the classifier deals with packets and how it switches them to the proper context. Since the default gateway for a firewall is usually found on the outside interface, the destination IP address in a packet might be any IP not found inside. The classifier has no way of knowing which default gateway should be chosen, since there are no IP routing e