Is it possible to implement such a cunning type of access?

Question

Computer networks

Good afternoon dear! I appeal to the great minds of Tsiskari and others like them.

It is necessary to organize a very cunning network access scheme, in my opinion, or to have a complete understanding that it is absolutely impossible to do this.

So, there is cisco ASA. The scheme is slightly more advanced than the classical one. 4 interfaces - inside, outside, DMZ1 and DMZ2. Hosts from DMZ1 and DMZ2 access the Internet statically beforehand. That is, the Internet is available to them, they are available to the Internet.

There is a host in DMZ1 with an internal address, well, for example, 172.16.1.10, it is statically snnated at 66.66.66.66. There is a host in DMZ2 with an internal address of 192.168.2.50, it is statically snnated at 77.77.77.77. That is, addresses from "different DMZs" are natted to white addresses from different subnets. These subnets are routed outside by a router (not ASA - a router behind an outside interface).
Attention to the question - is it possible to implement access so that these two hosts are still perfectly visible from the Internet at the specified white addresses, but at the same time they can interact with each other using them - that is, 66.66.66.66 <--> 77.77.77.77?

I perfectly understand that for such tasks you need to use DNS and not bother, but still you need to try without DNS.
I intuitively understand that this is not possible - ASA simply cannot wrap traffic according to such a scheme, simply based on the principle of functioning of fundamental technologies (routing and NAT).

But can all the same it is possible to implement it by means of cisco? M.b. cunning what rout-maps?

And if possible, is it possible to implement all this if external addresses are used from the same range?

Thank you in advance for your response.

Answer 1

I intuitively understand that this is not possible.

Not really. The packet can snitch, go outside (as the routing table says for this prefix or for 0/0), bounce back from the provider (or its own) router (since all paths in the routing table lead back), snitch again and hit the target. A little clumsy, but it will work. Well, what else is iron?
There are no tricky polymaps, ACA can't PBR.

Answer 2

If all hosts in DMZ1/2 have public ips assigned, then why nat? Remove nat, make a route and packets will run directly between hosts, according to acl. Another question - if hosts in different DMZs need to interact directly, then maybe they need to be placed in the same DMZ?