4

I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it is sourced and destinated to the same interface. Did any one ever tried such setup? Did it work? I see it is logical and possible

  • Are you saying you want client VPN users to be able to pass traffic through a site-to-site VPN terminated on the same ASA? – Jesse P. Sep 11 '18 at 3:00
  • If so, yes that's easy and very common. If you can edit your question to include a sanitized copy of your running configuration along with the details of which tunnel you want to talk to which other tunnel, we can help you script out the changes. – Jesse P. Sep 11 '18 at 3:02
  • We are still waiting for you to provide more information in order to accurately answer your questions. – Jesse P. Sep 11 '18 at 18:14
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:28
0

If you want to permit flows of traffic, that coming in on an interface and to be routed back out the same interface

same-security permit intra-interface

it's called hairpinning: https://community.cisco.com/t5/security-documents/hairpin-u-turn-traffic-off-an-interface-on-an-asa-running-8-3-or/ta-p/3129668

  • While that is somewhat correct, and you could POTENTIALLY need hairpinning (depending on whether or not there are same or separate interfaces for client VPN and site-to-site VPN), there are other things to account for such as interesting traffic ACL modifications, NAT (or NAT exemption) modifications, possible routing statement modifications, etc. – Jesse P. Sep 11 '18 at 18:13
  • yes and you should have ASA in place to – tyler durden Sep 11 '18 at 19:05
  • I'm confused. This post is about having an ASA and using it for VPNs. What do you mean by "have ASA in place to"? – Jesse P. Sep 11 '18 at 19:09
  • well, of course he should account for other things to, his question is about traffic coming and leaving the same interface and it's hair pinning. – tyler durden Sep 11 '18 at 19:43
  • That's fair in this case but, it's up to the people here that offer help (by answering questions) to look beyond the obvious question and make sure that the OP has everything they need that may not have been thought of, since they're usually asking a question because they don't already know how to do it. I feel your answer is too black and white. If the user didn't account for everything I previously mentioned, simply enabling hairpinning won't change the final result. – Jesse P. Sep 11 '18 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.