Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I have three hosts connected to my ASA; two security cameras and one server running the security software.
All ports belong to one interface, all on the same VLAN. The cameras and server can access each other just fine, but I don't have "Enable traffic between two or more hosts connected to the same interface" selected. Shouldn't that be required for this to work, or am I misunderstanding it?
I don't believe the ASA is considering the ports to "all belong to one interface". One might say they "share" an SVI, but that's unrelated. Traffic between ports of the same VLAN aren't being routed.
The feature you're referring to allows the ASA to 'hairpin' route, or send traffic back out the same interface on which it arrived.
Take for example this contrived topology:
R1, FW1, and R3 share the 10.0.0.0/24 network. R1 has a default route to FW1. R3 is advertising 192.168.0.0/24 to FW1 via EIGRP.
To reach 192.168.0.0/24, R1 uses its default route to FW1, where the traffic ingresses on Gi0/0. FW1 can then route it back out Gi0/0 to R3.
If you do a search for 'ASA allow hairpinning' you'll probably find a few more realistic examples.
