0

I have three hosts connected to my ASA; two security cameras and one server running the security software.

All ports belong to one interface, all on the same VLAN. The cameras and server can access each other just fine, but I don't have "Enable traffic between two or more hosts connected to the same interface" selected. Shouldn't that be required for this to work, or am I misunderstanding it?

1
  • 1
    If all ports belong to one interface i suppose all hosts are connected to a switch and then connected to the ASA? – user36472 Jul 9 '17 at 17:26
2

I don't believe the ASA is considering the ports to "all belong to one interface". One might say they "share" an SVI, but that's unrelated. Traffic between ports of the same VLAN aren't being routed.

The feature you're referring to allows the ASA to 'hairpin' route, or send traffic back out the same interface on which it arrived.

Take for example this contrived topology: enter image description here

R1, FW1, and R3 share the 10.0.0.0/24 network. R1 has a default route to FW1. R3 is advertising 192.168.0.0/24 to FW1 via EIGRP.

To reach 192.168.0.0/24, R1 uses its default route to FW1, where the traffic ingresses on Gi0/0. FW1 can then route it back out Gi0/0 to R3.

If you do a search for 'ASA allow hairpinning' you'll probably find a few more realistic examples.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.