topic Re: same security traffic in Network Security

same security traffic

lcaruso — Mon, 11 Mar 2019 20:04:39 GMT

Hi,

I've been tasked with cleaning up some old client configurations. Can anyone list the legitimate uses of

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

I know intra-interface can be used for hairpinning remote access vpn connections. What else?

I know inter-interface can be used to avoid the need for nat when to interfaces need to communicate. What else?

If you were considering whether or not to remove these statements, what speficially would you be looking for?

Thanks.

Re: same security traffic

Jennifer Halim — Thu, 10 Mar 2011 23:26:52 GMT

The "same-security-traffic" is used to avoid the need to configure access-list to allow communication flow between the 2 or more interfaces in the same security level. NAT still needs to be configured despite the "same-security-traffic" command.

Further to that, it also enables traffic to be routed in and out the same interface for "permit intra-interface", ie: hairpin as you have described it.

If you are considering to remove:

"inter-interface" --> look to see if you have any interfaces having the same security level. If you don't, then it's safe to remove.

"intra-interface" --> VPN hairpin as well as if you have a need to hairpin traffic in and out the same interface.

Hope that helps.

Re: same security traffic

lcaruso — Thu, 10 Mar 2011 23:40:11 GMT

First, thanks for your reply and giving me good ideas as to what to look for. Then, regarding your statement

NAT still needs to be configured despite the "same-security-traffic" command

Sorry, but I found someone who disagrees with this statement

Cisco ASA, PIX, and FWSM Firewall Handbook (2nd Edition)

David Hucaby (Author)

6-2: Address Translation

Cisco firewalls provide security policies and traffic inspection using two basic principles:

• Address translation—When a host on one firewall interface initiates a connection to a host on

a different interface, the firewall must provide a way to translate the IP addresses across itself

appropriately. Even if the IP addresses should appear identically on both sides of the firewall, a

translation must still occur.

One exception to this is when the same-security-traffic command is used to allow

traffic to pass between interfaces with an identical security level. In that case, address

translation can still be configured if it is needed, but it is not required. The other

exception is when the no nat-control command is used. This is the default beginning

with ASA 7.0 and FWSM 3.1(1), which allows hosts to initiate connections through

the firewall without requiring address translation.

Re: same security traffic

Jennifer Halim — Fri, 11 Mar 2011 00:03:59 GMT

Spot on.... sorry, wrong information about the NAT with same-security-traffic

Here is the Cisco doc as well for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_overview.html#wpxref77088

and more about the same-security-traffic:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/intrface.html#wp1061479

Re: same security traffic

lcaruso — Fri, 11 Mar 2011 00:08:33 GMT

thanks for the links!

Re: same security traffic

lcaruso — Mon, 21 Mar 2011 23:18:36 GMT

I came across some practical examples in my work recently for the same-security-traffic permit-intra interface.

When the ASA is the default gateway for workstations at a site that also has another internal subnet not directly connected to the ASA which the ASA routes to, basically sending packets right back out the same interface they came from.

The other was VPN on a stick with a central hub site and several spokes.