The Cisco ASA is configured in multiple mode and the security contexts share the same outside physical interface. Which two packet classification methods can be
used by the Cisco ASA to determine which security context to forward the incoming traffic from the outside interface? (Choose two.)
A.
unique interface IP address
B.
unique interface MAC address
C.
routing table lookup
D.
MAC address table lookup
E.
unique global mapped IP addresses
Explanation:
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html
Unique Interfaces
If only one context is associated with the ingress interface, the ASA classifies the packet into that context. In transparent firewall mode, unique interfaces for
contexts are required, so this method is used to classify packets at all times.
Unique MAC Addresses
If multiple contexts share an interface, then the classifier uses the interface MAC address. The ASA lets you assign a different MAC address in each context to the
same shared interface, whether it is a shared physical interface or a shared subinterface. By default, shared interfaces do not have unique MAC addresses; the
interface uses the physical interface burned-in MAC address in every context. An upstream router cannot route directly to a context without unique MAC addresses.
You can set the MAC addresses manually when you configure each interface (see the “Configuring the MAC Address” section), or you can automatically generate
MAC addresses (see the “Automatically Assigning MAC Addresses to Context Interfaces” section).
NAT Configuration
If you do not have unique MAC addresses, then the classifier intercepts the packet and performs a destination IP address lookup. All other fields are ignored; only
the destination IP address is used. To use the destination address for classification, the classifier must have knowledge about the subnets located behind each
security context. The classifier relies on the NAT configuration to determine the subnets in each context. The classifier matches the destination IP address to either
a static command or a global command. In the case of the global command, the classifier does not need a matching nat command or an active NAT session to
classify the packet. Whether the packet can communicate with the destination IP address after classification depends on how you configure NAT and NAT control.
For example, the classifier gains knowledge about subnets 10.10.10.0, 10.20.10.0 and 10.30.10.0 when the context administrators configure static commands in
each context:
·Context A:
static (inside,shared) 10.10.10.0 10.10.10.0 netmask 255.255.255.0
·Context B:
static (inside,shared) 10.20.10.0 10.20.10.0 netmask 255.255.255.0
·Context C:static (inside,shared) 10.30.10.0 10.30.10.0 netmask 255.255.255.0