Hi, If one of the webserver farms wants to access an internet entity via DNS name resolution, how can it be opened up on the ASA since the actual IPs should be specified in the access-list. And it is possible that the IP returned by DNS may be differ...