Forcing an ASA to follow a specific route

[joaofarinha]

Can't get to figure out this one by myself or reading through previous answers...

My setup has two firewalls to the internet, one is for all internal users who want to access the internet and the other is an ASA5510 acting as VPN terminaton to remote workers accessing using Anyconnect.

Each of the firewalls has a public interface on the same network (ex. 196.160.100.192/26).

We have a server with a public interface, and all traffic (internal and external) has to access via the public ip (again in the same network as above) and there are different profiles and access levels on that server depending if you are accessing from an internal IP or a public IP.

Well, when users are connected thrugh the VPN, although they have an internal IP address, as they are accessing the server on the public IP, the ASA sends the packets through its external interface (direct connected route) instead of sending it to the default internal gateway that is a "trusted" entry point on the server.

Any way to force the ASA to send that traffic to the internal default gateway instead of sending it to the external (direct connected) interface?

Thanks in advance!

PS: I have no access to the server (appliance under warranty) so I can't make any changes to it...

[Marvin Rhoads]

Are your clients calling the server via its FQDN? Whether that or via direct IP, the ASA will send the packets according to what it knows as the the route to the IP address. If the address is on the outside how could it possibly route out the inside interface?

If there's an internal gateway to the server you imply that there's an internal IP also. In that case, you could have the clients call that IP directly - or send them a DNS server entry that will resolve the FQDN to the internal address.