Hello,
I have two DMZs defined as DMZ and DMZ2 on my ASAx 5545. They both have interfaces defined as such on the ASAx and similar policies. We have a DMZ switch with all devices from both DMZs plugged into it. There are two connections a piece going to each DMZ on the ASAX from the DMZ switch via access ports for vlans assigned to each DMZ. However, the connections going from the DMZ to the Core switch where all of our users and other equipment are defined are both access ports assigned to DMZ only. There is a management IP for the switch assigned from the pool of IPs assigned to DMZ2, though, and no layer 3 IP assigned for the DMZ vlan. Lastly, there are no layer 3 addresses assigned for either vlan on either the Core or DMZ SWITCH, except for the management IP on the DMZ switch for DMZ2. The pool of IPs for both DMZs exist otherwise only on the ASAx.
In addition to the connections the Core has to the DMZ switch, it also has connections to the ASAx to the inside, outside and management interfaces. It does not have a connection to either the DMZ or DMZ2 interfaces except through the DMZ switch.
The problem I have begins with not being able to ping devices for DMZ2 from the Core switch and access switches connected to the Core. I can ping these devices from the ASAx and the DMZ switch, however, and I can ping all devices for the DMZ from anywhere.
My questions, therefore, are twofold. First, why can I not ping all devices from all switches; and second, what are my options for setting this up so that I can disconnect my Core from the DMZ switch and still be able to ping all devices from everywhere?
