Inter vs Intra

There are 101 security levels on the ASA. This may not be enough and you might be required to use the same security level a few times. We know that higher security level interfaces can talk pass traffic to lower security interfaces by default but what if they are the same security level? By default this is not permitted. Even if you define access-lists to permit traffic it is still denied.

Inter-interface

Inter interface communication allows communications between different interfaces of the same security level.

ASDM

Navigate to Configuration > Device Setup > Interfaces

Select the check box entitled Enable traffic between two or more interfaces which are configured with the same security levels.

CLI

ciscoasa# conf t
ciscoasa(config)# same-security-traffic permit inter-interface

Intra-interface

Intra-interface permits flows of traffic that comes in on an interface and routed back out the same interface. By default this is denied by default. An example of this would be hair-pinning; Hub and Spoke VPN topologies utilize this methodology.

ASDM

Navigate to Configuration > Device Setup > Interfaces
Select the check box entitled Enable traffic between two or more hosts connected to the same interface.

CLI 

ciscoasa# conf t
ciscoasa(config)# same-security-traffic permit intra-interface

To disable either use the no form of the command.

One thought on “Inter vs Intra

Leave a Reply

Your email address will not be published. Required fields are marked *

*