ASA 5505 Cannot access out Public IPs from inside the network

I set the DNS rewrites but it still doesn't seem to be working

When you attempt to resolve the site name with nslookup or dig, does it return the internal or external ip address?

it returns "unknown"

Okay... and if the DNS rewrites are off, it returns the outside IP address?

both return and "unknown"

Can you post an edited copy of your ASA configuration and let me know whether the DNS server you're using is inside the firewall or outside?  I think I'll need to have a more complete look at the whole of your configuration to see what's up here.

Based on your post in your other question, have you resolved this one, too?
http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_24800947.html#a25543503

Read this;

http://www.rsivanandan.com/2006/07/17/dns-doctoring/

Cheers,
rsivanandan

I think the problem here is that the website address is for a different Domain. Our internal domain is "mycompany.local" while the website is "www.mycompanylandandlawn.com" and we host both domains

The fact that you're getting no valid DNS resolution for the host at all suggests a more basic problem than a NAT or DNS doctoring issue.  Are your internal DNS servers authoritative for mycompanylandlawn.com?

No...I just adopted this network last week and just installed the firewall last friday so I have yet to clean up DNS

Okay...  so you're doing requests to an external DNS from the internal network, but getting no name resolution for this particular site.  If you have that edited copy of your ASA configuration, it might help to have a look at it.

Oh. If the problem is only about resolving the internal network using www.mydomain.com while your internal AD is mydomain.local, then it is again fairly simple to resolve.

1. Create another domain for mydomain.com and create a CNAME record for www.mydomain.com and point it to your internal web server.

Then your internal clients can access it.

Cheers,
rsivanandan

I mean, create another domain in your DNS server of course :-)

Cheers,
rsivanandan

here is a screen shot of my current DNS

We host the DNS for the .com on an old NT server and I have set up FS4 with a primay zone for the .com is this correct?

FS4 is the primany DNS for the .local as well

Should .com be a secondary zone?

Yes, it should be and then create a PTR (CNAME) record for the web server.

Cheers,
rsivanandan

I get the following error

sorry...here is the error

You created another forward lookup zone right for mydomain.com ?

Cheers,
rsivanandan

This is going to be nearly impossible without a sanitized config.

(1) Create a forward lookup zone for the .com domain
(2) In that lookup zone, create an A record for "www" and point it to the internal IP of your webserver, the IP that hosts can see and ping internally.
(3) Clients will need to flush dns or reboot, then they'll be able to see it.

I'm assuming this webserver is behind your ASA, on the same subnet(s) as the clients who can't see it, yes?  What about email?  Are you getting email for the .com domain?  If so, once you create this forward lookup zone for it, the MX record will need to point to the mail server because your clients will see it as authoritative even though it's not.  If your mail server is inside, again, it's an A record pointing to the OS name, and an MX record, priority 10, pointing to the OS name (both pointing to the internal IP).