C H A P T E R 29 Setting General Ipsec Vpn Parameters - Cisco FirePOWER ASA 5500 series Configuration Manual

Permitting Intra-Interface Traffic
hostname(config)# sysopt connection permit-ipsec
Permitting Intra-Interface Traffic
The security appliance includes a feature that lets a VPN client send IPSec-protected traffic to another
VPN user by allowing such traffic in and out of the same interface. Also called "hairpinning", this feature
can be thought of as VPN spokes (clients) connecting through a VPN hub (security appliance).
In another application, this feature can redirect incoming VPN traffic back out through the same
interface as unencrypted traffic. This would be useful, for example, to a VPN client that does not have
split tunneling but needs to both access a VPN and browse the Web.
Figure 29-1
unencrypted traffic to a public Web server.
Figure 29-1
192.168.0.0
To configure this feature, use the same-security-traffic command in global configuration mode with its
intra-interface argument.
The command syntax is same-security-traffic permit {inter-interface | intra-interface}.
The following example shows how to enable intra-interface traffic:
hostname(config)# same-security-traffic permit intra-interface
hostname(config)#
You use the same-security-traffic command, but with the inter-interface argument, to permit
Note
communication between interfaces that have the same security level. This feature is not specific to IPSec
connections. For more information, see the "Configuring Interface Parameters" chapter of this guide.
To use hairpinning, you must apply the proper NAT rules to the security appliance interface, as discussed
in the following section.
Cisco Security Appliance Command Line Configuration Guide
29-2
shows VPN Client 1 sending secure IPSec traffic to VPN Client 2 while also sending
VPN Client Using Intra-Interface Feature for Hairpinning
Security
appliance
Unencrypted traffic
IPSec encrypted traffic
Chapter 29 Setting General IPSec VPN Parameters
Public web
server
Client VPN
laptop 2
192.168.0.11
Client VPN
laptop 1
192.168.0.10
OL-10088-01