Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 230 / 2164

1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Multiple Context Mode
Information About Security Contexts
Figure 1-5 shows the relationship between the default class and other classes. Contexts A and C belong
to classes with some limits set; other limits are inherited from the default class. Context B inherits no
limits from default because all limits are set in its class, the Gold class. Context D was not assigned to
a class, and is by default a member of the default class.
Figure 1-5 Resource Classes
Using Oversubscribed Resources
You can oversubscribe the ASA by assigning more than 100 percent of a resource across all contexts
(with the exception of non-burst VPN resources). For example, you can set the Bronze class to limit
connections to 20 percent per context, and then assign 10 contexts to the class for a total of 200 percent.
If contexts concurrently use more than the system limit, then each context gets less than the 20 percent
you intended. (See
Figure 1-6 .)
Figure 1-6 Resource Oversubscription
Default Class
Class Gold
(All Limits
Set)
Class Silver
(Some Limits
Set)
Class
Bronze
(Some
Limits
Set)
Context A
Context B
Context C
Context D
104689
Total Number of System Connections = 999,900
Maximum connections
allowed.
Connections denied
because system limit
was reached.
Connections in use.
1 2 3 4 5 6 7 8 9 10
Max. 20%
(199,800)
16%
(159,984)
12%
(119,988)
8%
(79,992)
4%
(39,996)
Contexts in Class
104895