1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Starting Interface Configuration (ASA 5510 and Higher)
Guidelines and Limitations
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
In multiple context mode, configure the physical interfaces in the system execution space according to
the “Starting Interface Configuration (ASA 5510 and Higher)” section on page 1-13. Then, configure the
logical interface parameters in the context execution space according to Chapter 1, “Completing
Interface Configuration (Routed Mode),” or Chapter 1, “Completing Interface Configuration
(Transparent Mode).”
Firewall Mode Guidelines
• For transparent mode, you can configure up to eight bridge groups per context or for a single mode
device.
• Each bridge group can include up to four interfaces.
• For multiple context, transparent mode, each context must use different interfaces; you cannot share
an interface across contexts.
Failover Guidelines
• When you use a redundant or EtherChannel interface as a failover link, it must be pre-configured on
both units in the failover pair; you cannot configure it on the primary unit and expect it to replicate
to the secondary unit because the failover link itself is required for replication.
• If you use a redundant or EtherChannel interface for the state link, no special configuration is
required; the configuration can replicate from the primary unit as normal.
• You can monitor redundant or EtherChannel interfaces for failover using the monitor-interface
command; be sure to reference the logical redundant interface name. When an active member
interface fails over to a standby interface, this activity does not cause the redundant or EtherChannel
interface to appear to be failed when being monitored for device-level failover. Only when all
physical interfaces fail does the redundant or EtherChannel interface appear to be failed (for an
EtherChannel interface, the number of member interfaces allowed to fail is configurable).
• If you use an EtherChannel interface for a failover or state link, then to prevent out-of-order packets,
only one interface in the EtherChannel is used. If that interface fails, then the next interface in the
EtherChannel is used. You cannot alter the EtherChannel configuration while it is in use as a failover
link. To alter the configuration, you need to either shut down the EtherChannel while you make
changes, or temporarily disable failover; either action prevents failover from occurring for the
duration.
• Although you can configure the failover and failover state links on a port channel link, this port
channel cannot be shared with other firewall traffic.
2. The maximum number of combined interfaces; for example, VLANs, physical, redundant, bridge group, and EtherChannel interfaces. Every interface
command defined in the configuration counts against this limit. For example, both of the following interfaces count even if the GigabitEthernet 0/0
interface is defined as part of port-channel 1:
interface gigabitethernet 0/0
and
interface port-channel 1
To Next Page
Loading...
Need help?
General
