ASA port redirection on same interface

spokofono — Fri, 21 Feb 2020 16:11:52 GMT

Hi,

I need to redirect traffic destined for port 444 to port 443 on outside interface. Basically same functionality as linux iptables:

*nat
-A PREROUTING -i eth0 -p tcp -m tcp --dport 444 -j REDIRECT --to-port 443

This is what i did (it's asav983-8 on virtualbox with standard host-only network):

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute 
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

object service real-vpn-port
 service tcp destination eq 444 
object service mapped-vpn-port
 service tcp destination eq https 
object-group network outside-host
 network-object host 192.168.56.1
object-group network asa
 network-object host 192.168.56.101
object-group service vpn
object-group network asa2
 network-object host 192.168.56.102
object-group network middle-host
 network-object host 192.168.56.103
access-list outside-in extended permit tcp host 192.168.56.1 host 192.168.56.102 eq https 
access-list outside-in extended permit tcp host 192.168.56.1 host 192.168.56.101 eq https 

nat (outside,outside) source static any any destination static asa2 asa service real-vpn-port mapped-vpn-port

http server enable
http 192.168.56.1 255.255.255.255 outside

And this is what i get:

%ASA-2-106016: Deny IP spoof from (192.168.56.1) to 192.168.56.102 on interface outside

Is it even possible to do this with asa?

Thank you for help.

topic ASA port redirection on same interface in Network Security

ASA port redirection on same interface