Networks Training

  • About
  • My Books
  • SUGGESTED TRAINING
  • HOME
  • Cisco Networking
    • Cisco General
    • Cisco IOS
    • Cisco VPN
    • Cisco Wireless
  • Cisco ASA
    • Cisco ASA General
    • Cisco ASA Firewall Configuration
  • Certifications Training
    • CCNA Training
    • Cisco Certifications
    • I.T Training
  • General
    • General Networking
    • IP Telephony
    • Network Security
    • Product Reviews
    • Software
  • Cisco Routers
  • Cisco Switches
You are here: Home / Cisco ASA Firewall Configuration / Permitting Traffic to Enter and Exit the Same Interface on Cisco ASA

Permitting Traffic to Enter and Exit the Same Interface on Cisco ASA

Written By Harris Andrea

With the older Cisco PIX firewall appliances, there was no way for traffic to enter a specific interface and then exit back from the same interface again. With the new Cisco ASA models, this is also not supported by default, but you can enable this functionality with the same-security-traffic permit intra-interface command.

Permit same security traffic intra interface

The schematic above shows a possible scenario where this functionality can be used. All internal hosts in network 10.0.0.0/24 have the ASA as default gateway (10.0.0.254) in order to access the Internet.

However, there is another internal network range (Branch Office: 192.168.10.0/24) which is accessible via a cisco router at 10.0.0.253. In order for the internal hosts to access this subnet, a static route must be configured on the ASA together with the “permit intra-interface” command, as shown below:

ciscoasa(config)# route inside 192.168.10.0 255.255.255.0 10.0.0.253 1
ciscoasa(config)# same-security-traffic permit intra-interface

All traffic from internal hosts destined to subnet 192.168.10.0 will be redirected by the ASA firewall through the Cisco router. The feature above is supported in versions 7.2(1) and later.

MORE READING:  Cisco ASA and DNSSEC-Probable Issue with Packet Size

It is also called “hairpinning” as you can find it on some VPN configurations where you terminate remote users on the ASA outside interface and then they are allowed to get out from the same interface (outside) towards the Internet.

same-security-traffic permit intra-interface VS inter-interface

A similar command is the same-security-traffic permit inter-interface. This command allows traffic to enter an interface of certain security level and then exit from another interface of the SAME security level.

For example assume you have two internal security zones (inside1 and inside2) having the same security level of 90. By default, the ASA does not allow traffic to enter and exit interfaces of the same security level. With the command above you can allow this communication between same security level interfaces.

Related Posts

  • Prevent Spoofing Attacks on Cisco ASA using RPF
  • Configuring Connection Limits on Cisco ASA Firewalls – Protect from DoS
  • Configuring AAA Authentication-Authorization-Accounting on Cisco ASA Firewall (TACACS+, RADIUS)
  • Cisco ASA Firewall Management Interface Configuration (with Example)
  • How to Configure Access Control Lists on a Cisco ASA 5500/5500-X Firewall (with Examples)

Filed Under: Cisco ASA Firewall Configuration

Download Free Cisco Commands Cheat Sheets

Enter your Email below to Download our Free Cisco Commands Cheat Sheets for Routers, Switches and ASA Firewalls.

We use Elastic Email as our marketing automation service. By submitting this form, you agree that the information you provide will be transferred to Elastic Email for processing in accordance with their Terms of Use and Privacy Policy. Also, you allow me to send you informational and marketing emails from time-to-time.

About Harris Andrea

Harris Andrea is an Engineer with more than two decades of professional experience in the fields of TCP/IP Networks, Information Security and I.T. Over the years he has acquired several professional certifications such as CCNA, CCNP, CEH, ECSA etc.

He is a self-published author of two books ("Cisco ASA Firewall Fundamentals" and "Cisco VPN Configuration Guide") which are available at Amazon and on this website as well.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search this site

About Networks Training

We Provide Technical Tutorials and Configuration Examples about TCP/IP Networks with focus on Cisco Products and Technologies. This blog entails my own thoughts and ideas, which may not represent the thoughts of Cisco Systems Inc. This blog is NOT affiliated or endorsed by Cisco Systems Inc. All product names, logos and artwork are copyrights/trademarks of their respective owners.

Amazon Disclosure

As an Amazon Associate I earn from qualifying purchases.
Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates.

Search

BLOGROLL

Tech21Century
Firewall.cx

Copyright © 2023 | Privacy Policy | Terms and Conditions | Hire Me | Contact | Amazon Disclaimer | Delivery Policy

1 shares