ASA8.4 L2L to L2L Hairpinning

[mikedeyoung]

Hi All,

I am stumped on how to configure hub-end-ASA to hairpin between two spokes both configured for L2L VPN with Hub-ASA.

ASA2 <- L2LVPN -> ASA1 (works)

ASA3 <- L2LVPN -> ASA1 (works)

ASA3 <-L2LVPN -> ASA1 <-L2LVPN-> ASA2  (fails)

My configuration filtered on relevent syntax...

same-security-traffic permit intra-interface

nat (outside,outside) source static ASA2 ASA2 destination static ASA3 ASA3

nat (outside,outside) source static ASA3 ASA3 destination static ASA2 ASA2

Any help would bring goodness into the world.

Thx

[Nicholas Carrieri]

I would have to take a look at your interesting ACLs and make sure that they include the subnets from ASA2 going to the subnets of ASA3.  I'm assuming you already did a packet tracer on the outside to see what the ASA will do with the traffic.  I hope this helps.