Question

A company hosts a web server in the DMZ zone (192.168.50.10) of a Cisco Secure Firewall Threat Defense (FTD) appliance. External users reach it via the public IP 203.0.113.10 using a static NAT rule. Internal users on the inside zone report that when they browse to the server's public FQDN (which resolves to 203.0.113.10), the connection fails, even though external access works fine. What must the administrator configure on the FTD to allow internal users to reach the DMZ server using its public IP?

Accepted Answer

A NAT hairpin (U-turn) configuration permitting traffic to enter and exit the same or interconnected interfaces, along with an access control rule allowing inside-to-DMZ traffic

Answer

A twice-NAT rule that translates the inside users' source addresses to the DMZ server's real IP address

Answer

A prefilter fastpath rule to bypass NAT processing for internal-to-DMZ flows

Answer

An identity NAT exemption rule disabling all address translation between the inside and DMZ zones