I have situation where remote access ipsec client have to connect to ASA firewall to send and receive traffic using site to site tunnel on the same ASA, in the logs I am seeing packets dropped as it is sourced and destinated to the same interface. Did any one ever tried such setup? Did it work? I see it is logical and possible
4
-
Are you saying you want client VPN users to be able to pass traffic through a site-to-site VPN terminated on the same ASA?– Jesse P.Sep 11, 2018 at 3:00
-
1If so, yes that's easy and very common. If you can edit your question to include a sanitized copy of your running configuration along with the details of which tunnel you want to talk to which other tunnel, we can help you script out the changes.– Jesse P.Sep 11, 2018 at 3:02
-
We are still waiting for you to provide more information in order to accurately answer your questions.– Jesse P.Sep 11, 2018 at 18:14
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Dec 25, 2018 at 9:28
Add a comment
|
1 Answer
If you want to permit flows of traffic, that coming in on an interface and to be routed back out the same interface
same-security permit intra-interface
it's called hairpinning: https://community.cisco.com/t5/security-documents/hairpin-u-turn-traffic-off-an-interface-on-an-asa-running-8-3-or/ta-p/3129668
answered Sep 11, 2018 at 12:12
-
While that is somewhat correct, and you could POTENTIALLY need hairpinning (depending on whether or not there are same or separate interfaces for client VPN and site-to-site VPN), there are other things to account for such as interesting traffic ACL modifications, NAT (or NAT exemption) modifications, possible routing statement modifications, etc.– Jesse P.Sep 11, 2018 at 18:13
-
-
I'm confused. This post is about having an ASA and using it for VPNs. What do you mean by "have ASA in place to"?– Jesse P.Sep 11, 2018 at 19:09
-
well, of course he should account for other things to, his question is about traffic coming and leaving the same interface and it's hair pinning. Sep 11, 2018 at 19:43
-
That's fair in this case but, it's up to the people here that offer help (by answering questions) to look beyond the obvious question and make sure that the OP has everything they need that may not have been thought of, since they're usually asking a question because they don't already know how to do it. I feel your answer is too black and white. If the user didn't account for everything I previously mentioned, simply enabling hairpinning won't change the final result.– Jesse P.Sep 11, 2018 at 19:50