Permitting Intra Interface Traffic
The security appliance includes a feature that lets a VPN client send IPSec-protected traffic to another VPN user by allowing such traffic in and out of the same interface. Also called "hairpinning", this feature can be thought of as VPN spokes (clients) connecting through a VPN hub (security appliance).
In another application, this feature can redirect incoming VPN traffic back out through the same interface as unencrypted traffic. This would be useful, for example, to a VPN client that does not have split tunneling but needs to both access a VPN and browse the Web.
Figure 29-1 shows VPN Client 1 sending secure IPSec traffic to VPN Client 2 while also sending unencrypted traffic to a public Web server.
Figure 29-1 VPN Client Using Intra-Interface Feature for Hairpinning
Public web server
Figure 29-1 VPN Client Using Intra-Interface Feature for Hairpinning
Public web server
To configure this feature, use the same-security-traffic command in global configuration mode with its intra-interface argument.
The command syntax is same-security-traffic permit {inter-interface | intra-interface}.
The following example shows how to enable intra-interface traffic:
hostname(config)# same-security-traffic permit intra-interface hostname(config)#
Note You use the same-security-traffic command, but with the inter-interface argument, to permit communication between interfaces that have the same security level. This feature is not specific to IPSec connections. For more information, see the "Configuring Interface Parameters" chapter of this guide.
To use hairpinning, you must apply the proper NAT rules to the security appliance interface, as discussed in the following section.
Setting Maximum Active IPSec VPN Sessions H
Continue reading here: Configuring VPN Session Limits
Was this article helpful?
