I know from previous experience that having servers in DMZ 1 accessing the public NATed IPs of servers in DMZ 2 on the same ASA (aka "hairpinning") is a tricky business in a single-context ASA. But is this still an issue with a multi-context firewall?
We currently have a physical web server that will be virtualised onto the same firewall as some (but not all) of its users, in a different DMZ. This would normally cause issues, as above, and DNS re-writing isn't an option, as not all of the web services have DNS names. With multi-context, and the web server in its own context with a shared internet interface, is that enough separation that my request packets make it all the way outside before hitting the external NAT address?
This is with 8.3.x software.
