This is a very common problem, in the few months that I´m on this forum, I´ve seen many people having trouble understanding how nat, global and static work. In my humble opinion this is poorly documented on CCO, thus having nothing to do with being an idiot, or what so ever :-))
Sometimes I´m still confused why some things are not working the way we think it should work, but I always discovered (at least till now) that if the Cisco ducumentation is followed, it always works.
You should remember the following:
1) When traffic initiates from a higher level security to a lower level security only and no translation are needed you should only use one of the following:
nat <(interface)> 0
nat <(interface)> 0
2) When traffic initiates from a higher level security to a lower level security only and translation are needed you should only use:
nat <(highlevelinterface)>
global <(lowlevelinterface)>
The static command is only needed in case traffic is initiated from a lower securitylevel to a higher securitylevel.
Be aware of one other thing: if static commands do overlap with nat and global commands you could run into unexpected behaviour like this.
Now to the point:
I think you have an overlap within your translations. Check to see if this is true, and if not, then check to see if the appropiate nat/global rules are set for traffic initiated from inside to dmz.
Hope this helps,
Leo
