Not working traffic inside of the same interface

Question

Hi Guys.
I need your help to configure a Cisco ASA 5510.
Connencted the a single interface I have a switch. To this switch (same VLAN) there are connected:
1. The Subnet of the main office (192.168.1.253)
2. A router  (IP 192.168.1.254) that routes the traffic to a remote location (Subnet 192.168.8.0/24)
I have so allowed any traffic incoming to the inside interface as follows:
access-list inside_access_in extended permit ip any any
and I have permitted traffic intra interface as follows:
same-security-traffic permit intra-interface
Then I created a static route:
route inside 192.168.8.0 255.255.255.0 EXTERNAL_ROUTER 1
Now I can successfully ping the destination:
Pinging 192.168.8.10 with 32 bytes of data:
Reply from 192.168.8.10: bytes=32 time=135ms TTL=123
Reply from 192.168.8.10: bytes=32 time=146ms TTL=123
Reply from 192.168.8.10: bytes=32 time=143ms TTL=123
Reply from 192.168.8.10: bytes=32 time=188ms TTL=123
Unfortunately I cannot RDP into that server. When I simulate the connection via Packet tracer, it tells me that the implicit deny on the bottom of the conncections from "inside" (firewall) does not allow the connection.
It sounds to me like that "same-security-traffic permit intra-interface" does work only if there are 2 interfaces and not a single one.
Unfortunately I cannot just unplug the cable and connect it into another port as the ip is on the same subnet and I cannot configure the other end router.
Please help :-(
Thanks,
Dario Vanin

Answer 1

Ahh OK, telco router.
You can quickly test if it's working by configuring the PC with static routes for 192.168.8.0/24 pointing towards the router (192.168.1.254).
Here is sample configuration on TCP State Bypass:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b2d922.shtml
access-list tcp-bypass-acl permit tcp 192.168.1.0 255.255.255.0 192.168.8.0 255.255.255.0
access-list tcp-bypass-acl permit tcp 192.168.8.0 255.255.255.0 192.168.1.0 255.255.255.0
class-map tcp-bypass-cm
   match access-list tcp-bypass-acl
policy-map tcp-bypass-policy
   class tcp-bypass-cm
       set connection advanced-options tcp-state-bypass
service-policy tcp-bypass-policy inside