command-line kind of guy. This chapter deals with configuring ASAs using the command line, and does not cover the ASDM. The ASDM is a pretty great tool, however, and I encourage you to explore its use on your own. Contexts Many ASAs can be divided into multiple contexts. Similar in principle to the way VMware allows multiple servers or workstations to reside on a single physical machine, multicontext mode allows multiple virtual firewalls within a single physical ASA. While VMware allows for multiple operating systems to run on a single machine, there is no such versatility allowed here. Multicontext mode allows multiple logical ASAs, and only ASAs, to appear within a single box. Each ASA appears as if it were a standalone unit, though there are some fairly severe tradeoffs to this. In multicontext mode, the following features are disabled: OSPF, RIP, and EIGRP; multicontext mode supports only static routes Multicast routing (multicast bridging is supported) Threat detection Phone proxy As you can see, those are some pretty important features for a lot of installations. The inability to use VPN is a deal-breaker for many companies considering multicontext mode. If your needs tend toward regular firewalling, and you don't need any of the items just listed, multicontext mode can be a cool way to get your money's worth from an ASA. We'll talk about contexts in detail later in this chapter. For now, though, you need to know that the command prompt on a multicontext ASA, by default, is com- posed of hostname/context-name# The ASA I use in my examples is named ASA-5540. Any commands issued from within a context use the context named GAD. For example, this is what config mode looks like from the system (default) context: ASA-5540# And this is what the command line looks like in the GAD context: ASA-5540/GAD# Interfaces and Security Levels Each interface in an ASA firewall must have a physical name, a logical name, a security level, and an IP address. Interfaces may also be configured for features such as speed and duple