Showing results for 
Search instead for 
Did you mean: 


Cisco ASA Question - Hairpinning?

5 Years ago we merged 2 companies each with its own network and different software applications for external clients to access. Company A has a Sophos UTM 9 firewall with the inside LAN on, and Company B has a Cisco ASA 5510 with the inside LAN on Both have VPN connections going to their respective networks.


Because the ASA 5510 went End Of Life last year, I am in the process of trying to move all of our VPN connections from the ASA to our Sophos firewall on the COMPANY A network. Until now, I have kept the COMPANY A and COMPANY B networks separate. Our plan is to utilize an unused interface on the Sophos firewall to connect to the COMPANY B network and have all the VPN connections go through the Sophos without readdressing the COMPANY B network. ASA internal LAN interface and Sophos internal COMPANY B interface are connected to the same non-managed switch on the COMPANY B network.


The problem I am running into appears to be routing in the ASA. I can bring up a VPN tunnel on the Sophos pointed to the COMPANY B network, but cannot get traffic to pass.


I have tried setting a static route in the ASA directing all traffic destined for my test network ( through the Sophos interface ( If I set a static route in one of the COMPANY B terminal servers (route add mask I can log into that terminal server through the VPN from my test network to the Sophos. I was expecting to be able to put that static route in the ASA for each remote network as they are moved since the ASA inside interface ( is currently the default gateway for all the COMPANY B servers.


I have entered the command “same-security-traffic permit intra-interface” in the ASA with no luck.


Am I missing something simple like a rule or something that I need to add to the ASA? Once I remove all of the VPNs from the ASA, I will just change the default gateway on all the COMPANY B servers to point to the Sophos.

Everyone's tags (3)

Re: Cisco ASA Question - Hairpinning?

I understand its very difficult thing to accomplish. No answer so far

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards