ASA traffice get denied when ingress and egress is the same one

[Ge Qu]

Hi,

I have a firewall that trffice goes in to interface xxx and I allowed from host A to host B, but i also have a route to route the traffic destinated to B to interface XXX.

However, I always get deny from A to B, if I remove the route to interface XXX, I am not getting the deny anymore.

Is this a feature on ASA that I cannot receive and send the traffice on the same interface?

Thank you.

[Dinesh Moudgil · Accepted solution]

Hi,

Check this command:
same-security-traffic permit {inter-interface | intra-interface}

By default, traffic ingressing and egressing from same interface is not allowed. You need to enable the command to do so.

Reference:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s1.html#wp1421315

Regards
Dinesh Moudgil

P.S. Please rate helpful posts.

[Ge Qu]

Hi Dinesh,

Thank you for your reply. It resolved my issue.

I have another question. Can i add 2 static routes to the same destination but next hop is different? For example:

route AAA 0.0.0.0 0.0.0.0 1.2.3.4

route BBB 0.0.0.0 0.0.0.0 5.6.7.8

and if it's possible, the traffice will be load balanced between those 2 interface?

Thank you.

[Dinesh Moudgil · Accepted solution]

You can check the following document to leverage both ISPs at the same time

https://supportforums.cisco.com/document/59986/loadbalancing-dual-isp-asa

Regards
Dinesh Moudgil

P.S. Please rate helpful posts.