Glad to hear that now the VPN is working. So that leaves the DMZ and some cleanup to be done. Part of the DMZ will be easy. On the switch have a DMZ vlan (layer 2). Assign a SG port to that vlan and connect that access port to an interface on the ASA. Assign other ports on SG in the DMZ vlan for device connection as needed. On the ASA interface configure the interface for DMZ (IP address, security level, and configure whatever security policies you need for the DMZ.
Enforcing separation of DMZ from users will be a bit more challenging. If we had an IOS device we could possibly use something like VRF lite or like Policy Based Routing to restrict user access to the DMZ and control access from DMZ to users. I doubt that things like that are available on SG. The ASA will be the better place to enforce restrictions for access to DMZ resources. We can do that by not allowing the SG to route between user subnets and the DMZ. You can accomplish this by not configuring an SVI for the DMZ vlan on the SG. The SG might have a route for the subnet of DMZ (similar to the route that you have for VPN subnet) or it might be sufficient for the SG to use the default route. Anyway when a user wants to access the DMZ we need the SG to use the ASA as the next hop to access the DMZ. And if any device in DMZ wants to access inside subnets we need that device to send its traffic using the ASA rather than routing directly between DMZ and user subnets.
It is tempting to think about configuring access lists etc on the SG to enforce security. But that really would be pretty difficult and might not work so well. I believe that not having an SVI for DMZ on SG will be a more effective solution.
HTH
Rick
HTH
Rick
