Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Hairpinning on ASA

We currently have a Juniper 5gt with the internal ip of 172.16.1.254.  We are replacing it with an asa.

We have a couple of dumb switches and an MPLS router with an IP of 172.16.1.253.  Right now everything is fine.  The internet traffic goes through the juniper with no problem and the other traffic goes over MPLS as it should.

The default route is 1.254 for everyone.

When I put in the ASA the internet still works and I can PING over our MPLS but no data actually goes across.  What I mean by that is you cant connect to anything, browse the network etc.

I enabled hairpinning and put in routes so that traffic bound for our other networks (172.16.10.0 for example) to point to our MPLS router.


Any ideas?

1 REPLY
Cisco Employee

Re: Hairpinning on ASA

Hello,

You are experiencing asymmetric routing in your network. Firewall blocks TCP

traffic when it does not see bidirectional traffic through itself. If you

are running 8.2 code version, you can configure TCP State bypassing on the

inside interface. If you running code prior to 8.2, then I think the best

solution would be to swap the IP's of the ASA and the MPLS router i.e. let

the MPLS router have the IP of .254 and ASA .253. On the MPLS router, have

the default gateway as .253.

Here is the link that explains TCP State Bypass configuration.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns

_tcpstatebypass.pdf

Hope this helps.

Regards,

NT

453
Views
0
Helpful
1
Replies