Example 3: Department 1 Context Configuration - Cisco FirePOWER ASA 5500 series Configuration Manual

Example 3: Shared Resources for Multiple Contexts
security-level 100
ip address 10.1.0.1 255.255.255.0
no shutdown
interface gigabitethernet 0/0.300
nameif shared
security-level 50
ip address 10.1.1.1 255.255.255.0
no shutdown
passwd v00d00
enable password d011
route outside 0 0 209.165.201.2 1
nat (inside) 1 10.1.0.0 255.255.255.0
! This context uses PAT for inside users that access the outside
global (outside) 1 209.165.201.6 netmask 255.255.255.255
! This context uses PAT for inside users that access the shared network
global (shared) 1 10.1.1.30
! Because this host can access the web server in the Department 1 context, it requires a
! static translation
static (inside,outside) 209.165.201.7 10.1.0.15 netmask 255.255.255.255
! Because this host has management access to the servers on the Shared interface, it
! requires a static translation to be used in an access list
static (inside,shared) 10.1.1.78 10.1.0.15 netmask 255.255.255.255
access-list SHARED remark -Allows only mail traffic from inside to exit shared interface
access-list SHARED remark -but allows the admin host to access any server.
access-list SHARED extended permit ip host 10.1.1.78 any
access-list SHARED extended permit tcp host 10.1.1.30 host 10.1.1.7 eq smtp
! Note that the translated addresses are used.
access-group SHARED out interface shared
! Allows 10.1.0.15 to access the admin context using Telnet. From the admin context, you
! can access all other contexts.
telnet 10.1.0.15 255.255.255.255 inside
aaa-server AAA-SERVER protocol tacacs+
aaa-server AAA-SERVER (shared) host 10.1.1.6
key TheUauthKey
server-port 16
! The host at 10.1.0.15 must authenticate with the AAA server to log in
aaa authentication telnet console AAA-SERVER
aaa authorization command AAA-SERVER LOCAL
aaa accounting command AAA-SERVER
logging trap 6
! System messages are sent to the syslog server on the Shared network
logging host shared 10.1.1.8
logging enable

Example 3: Department 1 Context Configuration

interface gigabitethernet 0/0.200
nameif outside
security-level 0
ip address 209.165.201.4 255.255.255.224
no shutdown
interface gigabitethernet 0/0.202
nameif inside
security-level 100
ip address 10.1.2.1 255.255.255.0
no shutdown
interface gigabitethernet 0/0.300
nameif shared
security-level 50
ip address 10.1.1.2 255.255.255.0
no shutdown
Cisco Security Appliance Command Line Configuration Guide
B-10
Appendix B Sample Configurations
OL-10088-01