14-21
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter14 Completing Interface Configuration (Routed Mode)
Completing Interface Configuration in Routed Mode
Step4 To set the link-local address, enter an address in the Link-local address field.
A link-local address should start with FE8, FE9, FEA, or FEB, for example fe80::20d:88ff:feee:6a82.
See the “IPv6 Addresses” section on page A-5 for more information about IPv6 addressing.
Step5 Click OK.
Allowing Same Security Level Communication
By default, interfaces on the same security level cannot communicate with each other, and packets
cannot enter and exit the same interface. This section describes how to enable inter-interface
communication when interfaces are on the same security level, and how to enable intra-interface
communication.
Information About Inter-Interface Communication
Allowing interfaces on the same security level to communicate with each other provides the following
benefits:
•You can configure more than 101 communicating interfaces.
If you use different levels for each interface and do not assign any interfaces to the same security
level, you can configure only one interface per level (0to 100).
•You want traffic to flow freely between all same security interfaces without access lists.
If you enable same security interface communication, you can still configure interfaces at different
security levels as usual.
Information About Intra-Interface Communication
Intra-interface communication might be useful for VPN traffic that enters an interface, but is then routed
out the same interface. The VPN traffic might be unencrypted in this case, or it might be reencrypted for
another VPN connection. For example, if you have a hub and spoke VPN network, where the ASA is the
hub, and remote VPN networks are spokes, for one spoke to communicate with another spoke, traffic
must go into the ASA and then out again to the other spoke.
Note All traffic allowed by this feature is still subject to firewall rules. Be careful not to create an asymmetric
routing situation that can cause return traffic not to traverse the ASA.
Detailed Steps
•To enable interfaces on the same security level to communicate with each other, from the
Configuration > Interfaces pane, check Enable traffic between two or more interfaces which are
configured with same security level.
•To enable communication between hosts connected to the same interface, check Enable traffic
between two or more hosts connected to the same interface.