I have a Cisco ACE 4710 load balancer, with an interface configured as:
interface gigabitEthernet 1/4 speed 100M duplex FULL switchport trunk allowed vlan 100-999 no shutdown
Each VLAN represents a client, whose traffic should be kept separate. Gi1/4 is plugged into a similar trunk port on a Catalyst switch. There is an ASA firewall with VLAN sub-interfaces, each with the same
security-level, which prevents (for example) VLAN100 from talking to VLAN200.
On the ACE, I also have two contexts:
test-lb/Admin# show run context context CLIENTA allocate-interface vlan 100 context CLIENTB allocate-interface vlan 200
I would expect, at this point, to be able to
changeto CLIENTA and only configure
interface vlan 100, but I can add entries for
interface vlan 200, too.
test-lb/CLIENTA# show run int interface vlan 100 ip address 172.31.100.20 255.255.255.0 nat-pool 10 172.31.100.100 172.31.3.60 netmask 255.255.255.255 pat service-policy input VLAN100_MMPOL no shutdown interface vlan 200 ip address 172.31.200.20 255.255.255.0 nat-pool 10 172.31.200.100 172.31.3.100 netmask 255.255.255.255 pat service-policy input VLAN200_MMPOL no shutdown
This prevents me from configuring the CLIENTB context with the IP address information for
interface vlan 200, even though CLIENTB is the context to which VLAN200 has been allocated.
The Cisco Command Reference for
After you allocate the interface to a user context, you can configure the interface in that context.
But it seems that this is true regardless of what I allocate.