ASA traffic flow question

[andrewswanson]

Hello

I have an edge ASA 5585-X SSP 20 (asa915-smp-k8.bin) which currently has SSL VPN enabled on the Outside interface for use by clients outside. I've been asked to move the termination of SSL VPN for Outside clients onto another ASA interface but I'm running into the same kind of issue highlighted in th following thread:

https://supportforums.cisco.com/discussion/11708986/should-inside-host-be-able-ping-asa-dmz-interface-ip

In the thread someone states that:

"traffic going to a distant, far-end interface will not be accepted by the ASA"

Is it the case that the traffic entering an ASA on one interface cannot be destined for the IP address of another ASA interface?

Thanks
Andy

[Marvin Rhoads · Accepted solution]

Yes that is the case (except for some corner case exceptions for ASA management).

[andrewswanson]

Thanks for the prompt response Marvin

Cheers

Andy