To permit communication between interfaces with equal security levels, or to allow traffic to enter and exit the same interface, use the same-security-traffic command in global configuration mode. To disable the same-security traffic, use the no form of this command.
ASAINB(config)# same-security-traffic permit { inter-interface | intra-interface }
ASAINB(config)#no same-security-traffic permit { inter-interface | intra-interface }
| inter-interface | Permits communication between different interfaces that have the same security level. |
| intra-interface | Permits communication in and out of the same interface. |
Points to keep in mind:
Allowing communication between same security interfaces (enabled by the same-security-traffic inter-interface command) provides the following benefits:
- You can configure more than 101 communicating interfaces. If you use different levels for each interface, you can configure only one interface per level (0 to 100).
- You can allow traffic to flow freely between all same security interfaces without access lists.
The same-security-traffic intra-interface command lets traffic enter and exit the same interface, which is normally not allowed. This feature might be useful for VPN traffic that enters an interface but is then routed out the same interface. The VPN traffic might be unencrypted in this case, or it might be reencrypted for another VPN connection. For example, if you have a hub and spoke VPN network, where the ASA is the hub, and remote VPN networks are spokes, for one spoke to communicate with another spoke, traffic must go into the ASA and then out again to the other spoke.