Cisco ASA Multi-Context Mode: Architecture, Use Cases, and Configuration

What Multi-Context Mode Is — and Isn't

Cisco ASA multi-context mode partitions a single physical ASA into multiple independent virtual firewalls, called security contexts. Each context has its own:

• Interface assignments
• Security policies (ACLs, NAT, inspection)
• Routing table
• Management plane (separate admin login)
• Connection table and stateful inspection state

A context cannot see the traffic of any other context. From the perspective of a network administrator logging into Context A, Context B doesn't exist.

What it is not: It is not a hypervisor. The underlying hardware resources (CPU, memory, connections) are shared across all contexts. Heavy utilization in one context affects the others. It is not a substitute for separate physical firewalls when true isolation is required — it is a cost and rack-space optimization.

---

---

When to Use Multi-Context Mode

Multi-context makes sense when:

1. You are a managed service provider servicing multiple clients from shared infrastructure. Each client gets their own context — complete policy isolation, their own NAT rules, their own admin access.
2. You have multiple compliance domains on the same physical box. PCI in one context, HIPAA in another, corporate in a third. Each context has its own audit trail and access controls.
3. You need to reduce hardware footprint without sacrificing logical separation. One 5555-X running 4 contexts instead of 4 separate 5516-Xs.
4. You want to delegate firewall management to separate teams. Each context can have its own admin credentials — the PCI team manages CTX-PCI, the corporate team manages CTX-CORP.

---

System Context vs. Security Contexts

System Context

The system context is the management plane of the multi-context ASA. You cannot pass traffic through it — it has no routing table and no connection table. Its sole job is:

• Defining which interfaces exist and allocating them to security contexts
• Creating and deleting security contexts
• Managing shared resources (disk, image files)
• The admin context (if defined) doubles as the default login context

You access the system context from a console or a dedicated management interface. All context configuration files are stored on flash and referenced from the system context.

Security Contexts

Each security context behaves exactly like a standalone ASA. It has its own configuration file (disk0:/context-name.cfg), its own policy, and its own admin login.

---

Enabling Multi-Context Mode

Warning: Changing to multi-context mode erases the running configuration. Do this on a new or backed-up device. You cannot undo it without erasing again.

# Step 1: Verify current mode
ASA# show mode
# Single mode — we will change this

# Step 2: Back up running config before converting
ASA# copy running-config tftp://192.168.1.10/asa-single-backup.cfg

# Step 3: Enable multi-context mode
ASA(config)# mode multiple
# WARNING: This command will convert the running configuration...
# Proceed? [confirm]  — Enter
# ASA reboots automatically

# Step 4: After reboot — verify you are in system context
ASA# show mode
# Multiple mode
ASA# show context
# Should show: admin context (created automatically)

---

Creating Security Contexts

# From the SYSTEM context

# Step 1: Define shared interfaces (subinterfaces for VLAN-based separation)
ASA(config)# interface GigabitEthernet0/0
ASA(config-if)#  no shutdown
ASA(config)# interface GigabitEthernet0/0.10
ASA(config-subif)#  vlan 10
ASA(config)# interface GigabitEthernet0/0.20
ASA(config-subif)#  vlan 20
ASA(config)# interface GigabitEthernet0/0.30
ASA(config-subif)#  vlan 30

# Step 2: Create the Corporate context
ASA(config)# context CTX-CORP
ASA(config-ctx)#  config-url disk0:/ctx-corp.cfg
ASA(config-ctx)#  allocate-interface GigabitEthernet0/0.10 outside
ASA(config-ctx)#  allocate-interface GigabitEthernet0/1 inside
ASA(config-ctx)#  description Corporate user segment

# Step 3: Create the PCI context
ASA(config)# context CTX-PCI
ASA(config-ctx)#  config-url disk0:/ctx-pci.cfg
ASA(config-ctx)#  allocate-interface GigabitEthernet0/0.20 outside
ASA(config-ctx)#  allocate-interface GigabitEthernet0/2 cde
ASA(config-ctx)#  description PCI Cardholder Data Environment

# Step 4: Create the Guest context
ASA(config)# context CTX-GUEST
ASA(config-ctx)#  config-url disk0:/ctx-guest.cfg
ASA(config-ctx)#  allocate-interface GigabitEthernet0/0.30 outside
ASA(config-ctx)#  allocate-interface GigabitEthernet0/3 wifi
ASA(config-ctx)#  description Guest Wi-Fi segment

---

Configuring a Security Context

Once a context is created, switch into it and configure it exactly like a standalone ASA.

# Switch from system context to CTX-CORP
ASA# changeto context CTX-CORP
ASA/CTX-CORP#

# Configure interfaces — names are the aliases assigned in system context
ASA/CTX-CORP(config)# interface outside
ASA/CTX-CORP(config-if)#  ip address 203.0.113.10 255.255.255.248
ASA/CTX-CORP(config-if)#  security-level 0
ASA/CTX-CORP(config-if)#  no shutdown
ASA/CTX-CORP(config)# interface inside
ASA/CTX-CORP(config-if)#  ip address 10.10.0.1 255.255.0.0
ASA/CTX-CORP(config-if)#  security-level 100
ASA/CTX-CORP(config-if)#  no shutdown

# Default route
ASA/CTX-CORP(config)# route outside 0.0.0.0 0.0.0.0 203.0.113.1

# Access list — permit outbound, deny inbound by default
ASA/CTX-CORP(config)# access-list INSIDE_OUT extended permit ip 10.10.0.0 255.255.0.0 any
ASA/CTX-CORP(config)# access-list INSIDE_OUT extended deny ip any any log
ASA/CTX-CORP(config)# access-group INSIDE_OUT in interface inside

# NAT — PAT corporate traffic through outside IP
ASA/CTX-CORP(config)# object network CORP-LAN
ASA/CTX-CORP(config-network-object)#  subnet 10.10.0.0 255.255.0.0
ASA/CTX-CORP(config-network-object)#  nat (inside,outside) dynamic interface

# Return to system context
ASA/CTX-CORP# changeto system

---

Resource Management

By default, all contexts share hardware resources equally. In production you should define resource classes to prevent one context from starving others.

# From the system context — define resource classes
ASA(config)# class PCI-CLASS
ASA(config-resource-class)#  limit-resource conns 50000
ASA(config-resource-class)#  limit-resource xlates 25000
ASA(config-resource-class)#  limit-resource syslog-messages rate 5000

ASA(config)# class CORP-CLASS
ASA(config-resource-class)#  limit-resource conns 200000
ASA(config-resource-class)#  limit-resource xlates 100000

# Assign classes to contexts
ASA(config)# context CTX-PCI
ASA(config-ctx)#  member PCI-CLASS
ASA(config)# context CTX-CORP
ASA(config-ctx)#  member CORP-CLASS

---

Common Multi-Context Pitfalls

---

Verification Commands

# System context — overview of all contexts
ASA# show context
# Lists all contexts, their state (Running/Disabled), config URL

ASA# show context detail
# Shows interface allocations per context and resource class assignment

# Check resource utilization per context
ASA# show resource usage context CTX-CORP
# Shows conns, xlates, hosts, syslogs — current vs. limit

# Within a security context — standard ASA commands work
ASA/CTX-PCI# show interface
ASA/CTX-PCI# show access-list
ASA/CTX-PCI# show conn count
ASA/CTX-PCI# show xlate count
ASA/CTX-PCI# show log | last 50