Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 231 / 2164

1-11
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Multiple Context Mode
Information About Security Contexts
Using Unlimited Resources
The ASA lets you assign unlimited access to one or more resources in a class, instead of a percentage or
absolute number. When a resource is unlimited, contexts can use as much of the resource as the system
has available. For example, Context A, B, and C are in the Silver Class, which limits each class member
to 1 percent of the connections, for a total of 3 percent; but the three contexts are currently only using 2
percent combined. Gold Class has unlimited access to connections. The contexts in the Gold Class can
use more than the 97 percent of “unassigned” connections; they can also use the 1 percent of connections
not currently in use by Context A, B, and C, even if that means that Context A, B, and C are unable to
reach their 3 percent combined limit. (See
Figure 1-7 .) Setting unlimited access is similar to
oversubscribing the ASA, except that you have less control over how much you oversubscribe the
system.
Figure 1-7 Unlimited Resources
Information About MAC Addresses
To allow contexts to share interfaces, you should assign unique MAC addresses to each shared context
interface.
The MAC address is used to classify packets within a context. If you share an interface, but do not have
unique MAC addresses for the interface in each context, then other classification methods are attempted
that might not provide full coverage. See the
“How the ASA Classifies Packets” section on page 1-3 for
information about classifying packets.
In the rare circumstance that the generated MAC address conflicts with another private MAC address in
your network, you can manually set the MAC address for the interface within the context. See the
“Configuring the MAC Address and MTU” section on page 1-10 to manually set the MAC address.
This section includes the following topics:
•
Default MAC Address, page 1-12
•
Interaction with Manual MAC Addresses, page 1-12
•
Failover MAC Addresses, page 1-12
•
MAC Address Format, page 1-12
Maximum connections
allowed.
Connections denied
because system limit
was reached.
Connections in use.
A B C 1 2 3
1%
2%
3%
5%
4%
Contexts Silver Class Contexts Gold Class
50% 43%
153211