@CiscoBrownBelt ForemostPayOnlinewrote:
Just checking community to see best option to reach multiple internal say web servers from certain sites across WAN/internet on the FTD?
I was thinking say manual static NAT to an object-group which contains the internal server objects or something?
For exposing multiple internal web servers to the WAN/Internet via an FTD, the **best option is to deploy a Reverse Proxy/Load Balancer in your DMZ**. A simple static NAT to an object-group won't differentiate between multiple internal web servers sharing the same public IP and standard web ports (80/443). Instead, your FTD will perform a static NAT translating your single public IP to the DMZ-located reverse proxy's private IP. The FTD's Access Control Policy will then allow traffic from the internet to the proxy, and from the proxy to your internal web servers, with robust threat inspection applied to both flows. This approach centralizes SSL, provides intelligent routing, enhances security by hiding internal structure, and allows for load balancing, making it superior to using multiple public IPs for each internal server.
