How can I get LAN users to use "outside" IP's of ASA

[whiteford]

Hi,

We have an ASA 5520 fireall with 20 public IP's which NAT'd to various web servers on the DMZ.

The thing is the internal LAN users can access them by typing in the internal IP of the server, but is it possible to treat the servers like an external company so if they type the public IP of FQDNS then it will be resolved?

Thanks

[noran01]

The easiest way to do this is if you are running your own internal DNS that forwards outbound. Just add FQDN records pointing to you internal ips. When an internal user types hosta.domain.com it would resolve to the internal ip and route accordingly.

This would only work if you had internal DNS, but also had an external DNS server hosting your public resources.

[Collin Clark]

It's easy, refer to the following link.

http://blogs.interfacett.com/mike-storm/2006/6/29/bidirectional-nat-on-a-cisco-pix-or-asa.html

Hope that helps.

[acomiskey]

static (dmz,inside) netmask 255.255.255.255

[whiteford]

Is this a NAT from internal to external IP?