Hi there,
In fact you will just need two seperate static statements (or more, if more adresses are used). The first one will do the translation from outside to DMZ and also provide the needed proxy-ARP for this translation. It could look something like this:
static (dmz, outside) 62.229.98.1 10.1.1.1 netmask 255.255.255.255
The other one will provide the translation from the DMZ if packets travel to the inside (you also need this static translation even if no translation is in fact taken place). The command used could look something like this:
static (inside, dmz) 10.10.0.0 10.10.0.0 netmask 255.255.0.0
This sample config would work. The problem which you discribe has probaly to do with overlapping between these two static commands. If you change the second static, for example in the following:
static (inside, dmz) 10.0.0.0 10.0.0.0 netmask 255.0.0.0
then you would have the problem occuring which you descibe, namely, that the dmz interface will try to proxy-ARP, even for the servers placed on the dmz segment, because they're simply belonging to the range 10.0.0.0/8, whizh is static translated (and thus proxy ARP-ed)
I had the same problem onces and this was the issue.
To be complete in this solution, although this option is not recommented, you can always use the following command to prevent proxy-ARP on the dmz interface:
sysopt noproxyarp
this command will stop all proxy-ARP on the dmz interface only, so, you have to take care with using this. Hope this helps.
