ASA with single interface and IP address as a VPN server only

Unanswered Question
Aug 7th, 2009
User Badges:
  • Bronze, 100 points or more

I was asked if it is possible to configure an ASA as a VPN RA server using only a single interface and IP address. I said no, but was then told that it is possible, but cannot find any examples of this. All my ASA work has involved using an outside and inside network on seperate subnets.

So, this ASA is to provide VPN termination only, its not used for firewalling between private and public networks.

I dont have any hardware here to try this on, if I configure 1 interface in theory I should be able to get internal users to point to that network for access to the network across the VPN. Also the RA users can use the same IP address to terminate their VPN sessions.

Encrypted and non-encrypted traffic will have to use the same interface, and I'm not sure if this can be done.

My experience tells me this is an invalid configuration, but that is only based on the way I've set up ASA's before.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Collin Clark Fri, 08/07/2009 - 06:28
User Badges:
  • Purple, 4500 points or more


So they want a box that terminates the VPN and then access the local network out the same interface? I assume is has a private IP and there is a border firewall that NATs to it? Sounds like an insecure solution.

Todd Pula Fri, 08/07/2009 - 06:54
User Badges:
  • Silver, 250 points or more

I don't run into this all that frequently but you can certainly configure it on the ASA. The underlying config would be similar to the config you would use if you wanted to hairpin RA client Internet traffic out the same interface on which it was received. This is achieved using the "same-security-traffic permit intra-interface" CLI.

aacole Fri, 08/07/2009 - 09:06
User Badges:
  • Bronze, 100 points or more

I had a look at that link before, but didnt think it did what I wanted. Having had another look I see what you mean, I think it will do, so I'll try it next week.




This Discussion