Allowing Communication Between Interfaces On The Same Security Level; Configuring Inter-Interface Communication - Cisco 7604 Configuration Manual

Allowing Communication Between Interfaces on the Same Security Level

Allowing Communication Between Interfaces on the Same
Security Level
By default, interfaces on the same security level cannot communicate with each other, even if you
configure NAT and access lists. Also, by default, traffic cannot enter and exit the same interface. This
section describes how to configure inter-interface and intra-interface communication, and includes the
following topics:
•
•

Configuring Inter-Interface Communication

Allowing communication between same security interfaces lets you configure more than 101
communicating interfaces. If you use different levels for each interface and do not assign any interfaces
to the same security level, you can configure only one interface per level (0 to 100).
If you enable NAT control, you do not need to configure NAT between same security level interfaces.
Note
See the
and same security level interfaces.
If you enable same security interface communication, you can still configure interfaces at different
security levels as usual.
To enable interfaces on the same security level to communicate with each other, enter the following
command:
hostname(config)# same-security-traffic permit inter-interface
To disable this setting, use the no form of this command.
If you use a same-security interface for both the outside and inside interfaces, you might want to enable
Note
the xlate-bypass command; in some situations, you can exceed the maximum number of xlates using
that configuration (see the
without xlate-bypass, the FWSM creates xlates for all connections (even if you do not configure NAT).
In a same-security-traffic configuration, the FWSM randomly chooses which same-security interface is
the "inside" interface for the sake of creating xlates. If the FWSM considers the outside same-security
interface as the "inside" interface, it creates xlates for every Internet host being accessed through it. If
there is any application (or a virus) on the internal network that scans thousands of Internet hosts, all
entries in the xlate table may be quickly exhausted.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
6-10
Configuring Inter-Interface Communication, page 6-10
Configuring Intra-Interface Communication, page 6-11
"NAT and Same Security Level Interfaces" section on page 16-14
"Managed System Resources" section on page A-4
Chapter 6 Configuring Interface Parameters
for more information on NAT
for limits). For example,
OL-20748-01