Hairpinning on ASA

[jwashburn]

We currently have a Juniper 5gt with the internal ip of 172.16.1.254.  We are replacing it with an asa.

We have a couple of dumb switches and an MPLS router with an IP of 172.16.1.253.  Right now everything is fine.  The internet traffic goes through the juniper with no problem and the other traffic goes over MPLS as it should.

The default route is 1.254 for everyone.

When I put in the ASA the internet still works and I can PING over our MPLS but no data actually goes across.  What I mean by that is you cant connect to anything, browse the network etc.

I enabled hairpinning and put in routes so that traffic bound for our other networks (172.16.10.0 for example) to point to our MPLS router.

Any ideas?

[Nagaraja Thanthry]

Hello,

You are experiencing asymmetric routing in your network. Firewall blocks TCP

traffic when it does not see bidirectional traffic through itself. If you

are running 8.2 code version, you can configure TCP State bypassing on the

inside interface. If you running code prior to 8.2, then I think the best

solution would be to swap the IP's of the ASA and the MPLS router i.e. let

the MPLS router have the IP of .254 and ASA .253. On the MPLS router, have

the default gateway as .253.

Here is the link that explains TCP State Bypass configuration.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns

_tcpstatebypass.pdf

Hope this helps.

Regards,

NT