topic Re: ASA Same-security interface permit intra-interface in Network Security

ASA Same-security interface permit intra-interface

juan-ruiz — Mon, 11 Mar 2019 16:14:55 GMT

I would like to know how to use this command and any other related commands I need to make traffic enter and leave the same interface.

Basic network topology layout:

Internal network of ASA is 10.0.0.0/16

Networks inside the ASA I need to reach 172.16.2.0/24, 10.255.255.0/24, and 10.0.5.0/24

I executed the same-security interface permit intra-interface without any luck.

I then created a static (inside,inside) 10.0.0.0 10.0.0.0 and I'm able to ping 10.255.255.x/24 I made sure the access-list on the inside interface allow source 10.0.0.0/16 to reach 10.255.255.0/24. I also made sure NAT exemption is configured too for this one network I'm working with but when I try to perform a TCP session to a host (10.0.120.20) that uses the ASA as a default gateway (10.0.100.244) I get the message.

Sep 13 2009 15:27:11 ASA02 : %ASA-6-106015: Deny TCP (no connection) from 10.0.120.20/3389 to 10.255.255.20/1141 flags SYN ACK on interface insid

Can someone assist me with this configuration using the same-security interface permit intra-interface

Thanks in advance.

Juan

Re: ASA Same-security interface permit intra-interface

JORGE RODRIGUEZ — Sun, 13 Sep 2009 20:25:38 GMT

Juan, Ive seen couple of similar threads before on this issue, quick searched this one thread, try this solution which should do the trick.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&topicID=.ee6e1fa&fromOutline=true&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc1d776/4

Re: ASA Same-security interface permit intra-interface

mikewillis — Thu, 29 Oct 2009 20:48:24 GMT

This the suggested link help you resolve this?

Re: ASA Same-security interface permit intra-interface

Panos Kampanakis — Thu, 29 Oct 2009 20:57:58 GMT

What the syslog tells you there is that the ASA sees the SYN-ACK but it hasn't seen the SYN.

Are both hosts behind the ASA?

If yes, why do you want traffic to hit the ASA (same security intra command)?

If the ASA doesn't see then TCP SYN and it is routed directly between the hosts and then it sees the SYN-ACK it will be dropped due to stateful inspection.

Re: ASA Same-security interface permit intra-interface

mikewillis — Thu, 29 Oct 2009 21:00:41 GMT

Both hosts are behind the ASA, however one host is behind a router which sits behind the ASA.

The combination of the stateful inspection command, the the static route pointing to itself has seemed to fix everything.