Firepower site to site vpn from a DMZ to an external site

[vicnetnoc]

Hi Folks

I am trying to setup a site to site VPN from a DMZ using a internal IP range NATed to an external IP number. Is this possible? I seem to be running into numerous difficulties when attempting to do this. The VPN tunnel is up and the other end can ping my end but I cannot ping to their end. 

[Marvin Rhoads]

Can you check "show crypto ipsec sa" to confirm the source and destination subnets have valid SAs?

Also check your NAT configuration to make sure you are treating the addresses as intended with respect to NAT.

If that all looks good then try a packet-tracer on the traffic and see how the device expects to handle it.