Pls. make sure you are following this:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/intrface.html#wp1049451
If you use subinterfaces, you typically do not also want the physical interface to pass traffic, because the physical interface passes untagged packets. This property is also true for the active physical interface in a redundant interface pair. Because the physical or redundant interface must be enabled for the subinterface to pass traffic, ensure that the physical or redundant interface does not pass traffic by leaving out the nameif command. I
Best thing is to collect packet captures and see what he issue may be.
capture command has a match keyword now to make it each to configure.
cap capdmz int dmz match ip ho 10.10.10.1 host 192.168.2.1
cap capin int inside match ip ho 10.10.10.1 host 192.168.2.1
sh cap capin
sh cap capdmz
to view the captures and issue
clear cap capin
cle cap capdmz
to clear them and collect fresh packets.
-KS
