Cisco ASA Series Cli Configuration Manual page 230

Information About Security Contexts
Figure 1-5
to classes with some limits set; other limits are inherited from the default class. Context B inherits no
limits from default because all limits are set in its class, the Gold class. Context D was not assigned to
a class, and is by default a member of the default class.
Figure 1-5
Context A
Using Oversubscribed Resources
You can oversubscribe the ASA by assigning more than 100 percent of a resource across all contexts
(with the exception of non-burst VPN resources). For example, you can set the Bronze class to limit
connections to 20 percent per context, and then assign 10 contexts to the class for a total of 200 percent.
If contexts concurrently use more than the system limit, then each context gets less than the 20 percent
you intended. (See
Figure 1-6
Max. 20%
(199,800)
(159,984)
(119,988)
(79,992)
(39,996)
Cisco ASA Series CLI Configuration Guide
1-10
shows the relationship between the default class and other classes. Contexts A and C belong
Resource Classes
Default Class
Class
Bronze
(Some
Limits
Set)
Class Gold
(All Limits
Set)
Context B
Figure 1-6.)
Resource Oversubscription
Total Number of System Connections = 999,900
16%
12%
8%
4%
1 2 3 4
Contexts in Class
Chapter 1
Context D
Class Silver
(Some Limits
Set)
Context C
5 6 7 8 9 10
Configuring Multiple Context Mode
Maximum connections
allowed.
Connections in use.
Connections denied
because system limit
was reached.