Welcome to the ASA multimode configuration video
We're going to build on the theory from the first is a multimode video.
If you haven't seen it yet iI recommend having a look at it first then come back here.
There is a link below in the description
In this video we're going to use a single physical ASA and create two contexts.
The first is the default context called admin, which is created automatically when multi mode is enabled
The second context is manually created, and is called 'edge'
In the system context we're going to take two physical interfaces g0/0 and g0/1 and add them to a port channel.
Two subinterfaces will be created from the port-channel based on VLAN 100 and 200.
One interface is allocated to each context
At the end of the config will make the 'edge' context the admin context.
The first step is to enable multimode
Making this change requires a reboot of the ASA.
The change from single-mode to multiple alone does not erase the existing config.
However, the config is renamed as a backup.
A default context called admin is created.
The original running-config is migrated to a new file called admin.cfg
The config file is a regular file from the system execution space
From within the context it's just the running config
Now let's have a look at this in action.
We'll start by enabling mode multiple
The ASA will warn your intention to restart and ask for confirmation
It will also confirm that it's okay to migrate the configuration to admin.cfg
At this point the ASA restarts
For brevity, the full restart process has been trimmed out of the video
If you'd like to see the restore process i've added this as a separate video
After the restart we can confirm that multiple mode has been enabled
We can also see that there is a single context called 'admin', and that the configuration is stored in a file called admin.cfg
Now we have a context to work with, we can create some interfaces
Interfaces, including port-channel and sub-interfaces are initially configured in the system context
In this example we'll take two interfaces and add them to a port channel
Two subinterfaces will then be created based on the port-channel
Of course, the switch that the ASA is connected to will need corresponding configuration
IP addressing, interface names, and security levels are assigned within the context, and can be done later
You may be wondering though, why take two interfaces join them in a port-channel, and then split them into two sub-interfaces again
Why not just leave them as two separate interfaces?
There are two reasons for this
The first is for scalability
What if more interfaces and needed later?
Sub-interfaces allow this to happen
Also, two interfaces allow redundancy
If one link fails all the sub-interfaces will stay up
As normal, each interface is added to a port-channel
Once the port-channel has been created, subinterfaces can be added
Each sub-interface is based on a VLAN
Keep in mind that sub-interfaces are not required for multiple mode
Normal interfaces or regular port-channel's are just fine
Next up, we will create an additional context
Each context needs to have a unique name. Each name can be up to 32 characters long
Optionally, each context may have a description
The new context will be called 'edge'
The file name for the running config is specified in the system execution space
The interfaces, having been configured in the system space, can now be allocated to the contexts
When allocating an interface, a mapped name may be given
We will see this in the config
We'll start by creating the context
As soon as the context is created will be in context configuration mode
From here, the interface can be allocated
The mapped name is 'int100'
This is what the interface will be called inside the context
The visible key word refers to whether the context knows about the real interface name
If the visible keyword is present the real interface name will show up in the output of some commands such as 'show interface'
Have a look at the context list and you can see that the edge context is present, and the interface has been allocated
However, the configuration file has not been specified
To fix this, this go back into context configuration and specify the config-url path
This may be on the local disk or somewhere remotely like an FTP server
This error simply means that the file does not already exist and must be created
If the file is already there, the context will attempt to use the contents as the config
Now the context has a config file
Let's allocate an interface to the admin context
By leaving the visible keyword out, only the mapped interface name will show up within the context
Let's connect to the edge context
We can see the mapped interface and the real interface
There can only be one!
One admin context that is...
By default the first context that was created is the admin context
In our case this is also named admin so this could get a bit confusing
Let's change our config to make the edge context the admin context
The admin context is changed in the system execution space
This is changed with the 'admin-context' command
When looking at the list of contexts, the star symbol shows the admin context
To finish up, have a look at the 'show context detail' command
This shows the contexts that have been created, their location on disk, and the interfaces; both real and mapped that have been allocated
Context configuration is now complete
Please check out the network direction website for more configuration details, such as a Resource Classes,
Virtual MAC addresses,
And restoring an ASA to single mode
If you've enjoyed this video, or if it's been helpful in any way, please like the video or drop a comment below
Please subscribe to this channel or follow me on Twitter to be notified of any new videos or articles
Thank you for watching