ASA Hairpin

[katheer4u]

Hi
Please can you advise me how can i nat the inside  hairpin traffic on ASA , and the web server allow only https  traffic

Please  see the attached image of the network diagram

[Rob Ingram · Accepted solution]

Hi,
If you are hairpinning the traffic (traffic entering and exiting the same interface) you will need the command "same-security-traffic permit intra-interface". The NAT rules will need to be accurate with the correct src/dst interfaces.

HTH

[katheer4u]

Dear RJI

Thanks its working now  i can browse  only the home page of website 

https://www.XXXXXXXXXXX.com working fine

and when i click log in page not working 

https://www.XXXXXXXXXXX.com/portal/login

please can you advise me 

thank you 

[Rob Ingram]

When you make this connection are you connecting from the PC on 192.168.200.x connecting to 192.168.100.100? Not sure why you'd need to be hairpinning there.

Please can you provide your configuration for review.

[katheer4u]

192.168.100.100 it's a web server and its rewrite to Https only and we dont have domain server to dns resolve

[Rob Ingram]

I'm not sure I understand your last point there.
What ACLs have you got configured?
Take a packet capture on the ASA and provide the pcap for review.

[Georg Pauwen · Accepted solution]

Hello,

below is what you would need for hairpinning HTTPS:

same-security-traffic permit intra-interface
!
interface GigabitEthernet0/1
nameif inside
security level 100
ip address 192.168.100.1 255.255.255.0
!
interface GigabitEthernet0/0
nameif outside
security level 0
ip address 80.200.122.100 255.255.255.0
!
object network WEBSERVER_PUBLIC
host 80.200.122.100
!
object network WEBSERVER_LOCAL
host 192.168.100.100
!
object service HTTPS
service tcp destination eq https
!
object-group network LOCAL_HOSTS
network-object 192.168.100.0 255.255.255.0
!
nat (inside,inside) source dynamic LOCAL_HOSTS interface destination static WEBSERVER_PUBLIC WEBSERVER_LOCAL service HTTPS HTTPS