Allocate-interface to an existing ASA context

Question

We have a active/active context firewall and would like to add an sub-interface to the exisitng context. Can someone share the link on how to do this?
All cisco documentation is for creating a context and allocating interface from scratch but I could not find any document for adding an interface to an exisiting context.
-Mohan

Answer 1

Ah, now I understand your question better.
Yes, you can just add the "allocate-interface " to the Context configurations while its in production. All that this command will do at this point is add another interface under the Context.
After you have added the interface with the "allocate-interface" command under the Context and move to the Context with the command "changeto context ", you will only see a interface with blank configuration and ALL of the configuration you had there before adding the new interface.
After this you simply start configuring the interface with "description", "nameif", "security-level", "ip address" and so on and start creating rules for it.
The situation that the Cisco quote above refers to is the following situation
You have a ready made configuration file for your ASA context
You load that file to the Flash of the ASA
You want to apply the configuration on the Flash to the Context you created  One reason for having a ready configuration might be that your previous ASA has broken down and you are now in the process of recovery with a replacement device and have all the configuration backups and are loading them to the ASA and creating all the Context that were on the previous ASA
IF you were to create the Context and immediately issue the "config-url" thats configuration refers to certain interfaces THEN naturally the ASA couldnt insert those old backup configurations to the Context as it didnt have those interfaces attached yet.
This is why that in the above case you would first attach the interfaces to the context and THEN insert the Flash filesystem path where the already ready configuration would be located that the Context could use to fully configure and restore the Context.
Now consider the more typical situation while configuring Contexts
You already have an Context with a "config-url" set where the Context configuration gets saved.
When you add a new interface to the Context, nothing happens to the current configuration or firewall operation
Because the current configuration doesnt refer to the new interface in any way it wont naturally get any configurations when you attach it to the Context.
When you move under the Context, you can just start configuring the interface settings and configuration related to that interface
AFTER you issue "write mem" command and save the configuration, it will be saved to the file/path configured in the "config-url" configuration and will after this naturally contain the new interfaces (and all related configurations) in its configurations.
So in shorts
If you are adding new interfaces to production firewalls you can just use the "allocate-interface" command.
If you have a ready made configuration before creating the actual context THEN you will have to make sure that the context has the interfaces attached BEFORE you attach the "config-url" configuration  witth the ready made file OR IF NOT it will only apply configuration for the interfaces which are attached before this. And naturally the global configurations that dont apply to any specific interface
Hopefully I wasnt too complex with the writing. Im pretty tired at the moment and hard to concentrate
Please rate if you have found the information helpfull And also ask more if needed.
- Jouni