Cisco Systems OL-16647-01 Invalid Classifier Criteria, Classification Examples

10-4
Cisco ASDM User Guide
OL-16647-01
Chapter 10 Configuring Security Contexts
Security Context Overview
static (inside,shared) 10.30.10.0 10.30.10.0 netmask 255.255.255.0
Note For management traffic destined for an interface, the interface IP address is used for classification.
Invalid Classifier Criteria
The following configurations are not used for packet classification:
• NAT exemption—The classifier does not use a NAT exemption configuration for classification
purposes because NAT exemption does not identify a mapped interface.
• Routing table—If a context includes a static route that points to an external router as the next-hop
to a subnet, and a different context includes a static command for the same subnet, then the classifier
uses the static command to classify packets destined for that subnet and ignores the static route.
Classification Examples
Figure 10-1 shows multiple contexts sharing an outside interface. The classifier assigns the packet to
Context B because Context B includes the MAC address to which the router sends the packet.
Figure 10-1 Packet Classification with a Shared Interface using MAC Addresses
Classifier
Context A Context B
MAC 000C.F142.4CDCMAC 000C.F142.4CDBMAC 000C.F142.4CDA
GE 0/1.3GE 0/1.2
GE 0/0.1 (Shared Interface)
Admin
Context
GE 0/1.1
Host
209.165.201.1
Host
209.165.200.225
Host
209.165.202.129
Packet Destination:
209.165.201.1 via MAC 000C.F142.4CDC
Internet
Inside
Customer A
Inside
Customer B
Admin
Network
153367