I know from previous experience that having servers in DMZ 1 accessing the public NATed IPs of servers in DMZ 2 on the same ASA (aka "hairpinning") is a tricky business in a single-context ASA. But is this still an issue with a multi-context firewall?

We currently have a physical web server that will be virtualised onto the same firewall as some (but not all) of its users, in a different DMZ. This would normally cause issues, as above, and DNS re-writing isn't an option, as not all of the web services have DNS names. With multi-context, and the web server in its own context with a shared internet interface, is that enough separation that my request packets make it all the way outside before hitting the external NAT address?

This is with 8.3.x software.

1 Answer 1


The answer was, yes, it is enough separation. From the point of view of DMZ 1, the DMZ 2 device is outside.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.