nerdexam
Cisco

300-730 · Question #65

Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA…

The correct answer is B. same-security-traffic permit intra-interface. Two AnyConnect clients connected to the same ASA outside interface cannot communicate with each other by default because the ASA blocks intra-interface traffic, requiring the 'same-security-traffic permit intra-interface' command.

Remote Access VPN

Question

Refer to the exhibit. Client 1 cannot communicate with client 2. Both clients are using Cisco AnyConnect and have established a successful SSL VPN connection to the hub ASA. Which command on the ASA is missing?

Options

  • Adns-server value 10.1.1.2
  • Bsame-security-traffic permit intra-interface
  • Csame-security-traffic permit inter-interface
  • Ddns-server value 10.1.1.3

How the community answered

(30 responses)
  • A
    3% (1)
  • B
    70% (21)
  • C
    20% (6)
  • D
    7% (2)

Why each option

Two AnyConnect clients connected to the same ASA outside interface cannot communicate with each other by default because the ASA blocks intra-interface traffic, requiring the 'same-security-traffic permit intra-interface' command.

Adns-server value 10.1.1.2

Configuring a DNS server address of 10.1.1.2 affects name resolution for VPN clients but does not resolve the Layer 3 packet forwarding restriction that prevents client-to-client communication.

Bsame-security-traffic permit intra-interfaceCorrect

By default, Cisco ASA drops packets that arrive on an interface and would exit the same interface, a behavior known as hairpinning restriction. The 'same-security-traffic permit intra-interface' command explicitly enables this hairpin forwarding, allowing VPN client traffic that enters the outside interface to be routed back out the same interface to reach another VPN client. Without this command, the ASA silently discards the inter-client packets even though both tunnels are up and functional.

Csame-security-traffic permit inter-interface

The 'same-security-traffic permit inter-interface' command allows traffic between two different interfaces that share the same security level, which is unrelated to the intra-interface hairpin issue affecting both clients on the same outside interface.

Ddns-server value 10.1.1.3

Adding a DNS server value of 10.1.1.3 addresses name resolution configuration, not the ASA's default behavior of blocking traffic that enters and exits the same interface.

Concept tested: ASA intra-interface hairpinning for AnyConnect client-to-client traffic

Source: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118997-configure-asa-00.html

Topics

#AnyConnect SSL VPN#same-security-traffic#intra-interface#hairpinning

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice