Follow:
ASA-FW# sh run
: Saved
:
ASA Version 7.0(8)
!
hostname ASA-FW
enable password      encrypted
passwd                encrypted
names
dns-guard
!

Potential Causes and Solutions:

    Firewall Rules:
        ICMP: Verify that ICMP traffic (ping) from the internal network to the DMZ zone is explicitly allowed in the firewall rules.
        Specific Ports: If you're trying to access specific services on the DMZ server (e.g., HTTP, HTTPS), ensure the corresponding ports are open in the firewall rules.
    NAT Configuration:
        Correct Translation: If NAT is in place, double-check that it's correctly translating internal IP addresses to the DMZ server's IP and vice versa.
        Return Traffic: Ensure firewall rules allow return traffic from the DMZ server back to the internal network.
    Routing:
        Internal PC: Confirm that the internal PC has a route to the DMZ network through the firewall.
        DMZ Server: Verify that the DMZ server has a route back to the internal network through the firewall.
    Server-Side Firewall:
        Internal Connections: If the DMZ server has its own firewall, make sure it's configured to allow connections from the internal network.
    Security Policies:
        ICMP Restrictions: Review any security policies that might block ICMP traffic, especially from the internal network to the DMZ.

Additional Troubleshooting Steps:

    Packet Capture: Use a packet capture tool to analyze network traffic and pinpoint where packets are being dropped.
    Firewall Logs: Review firewall logs for any relevant blocks or errors.
    Temporary Rule: Create a temporary rule to allow all traffic between the internal PC and DMZ server to isolate the issue.

Best Practices:

    Principle of Least Privilege: Grant only necessary permissions for access between the internal network and the DMZ.
    Regular Security Audits: Conduct regular audits of firewall rules and security policies to ensure ongoing protection.
    Documentation: Maintain clear documentation of network configuration and security policies for troubleshooting and maintenance.

Remember:

    Security Implications: Carefully consider security implications before enabling any rules or services.
    Professional Assistance: If you're unsure about troubleshooting or configuration, seek professional assistance from a qualified network administrator or security expert.

Make that the firewall provides a path for the DMZ server to return to the internal network.
Front-Server Firewall:
Internal Connections: Verify that the firewall on the DMZ server is set up to accept connections from the internal network if it is present.

Security Guidelines:
ICMP Restrictions: Examine any security guidelines that might prevent communication via ICMP, particularly between the internal network and the DMZ.

Think through security implications carefully before activating any services or rules.
Professional Help: Consult a trained network administrator or security specialist for professional help if you're unclear about configuration or troubleshooting.

Check if the firewall rules specifically permit ICMP traffic (pings) from the internal network to the DMZ zone.
Particular Ports: Verify that the proper ports in the firewall rules are open if you're attempting to access particular services (like HTTP or HTTPS) on the DMZ server.

you can add new rules to allow traffic lan to dmz dan dmz to lan

While the firewall is able to ping the DMZ server successfully, local PCs are unable to establish a connection. To address this, first, verify the firewall rules in place for communication between the DMZ and local networks. Ensure that appropriate access rules are configured to allow traffic between the DMZ and local zones. Check for any potential network misconfigurations, such as incorrect IP settings or subnet mismatches. Review the logs on the firewall for any denied traffic or error messages that may provide insights into the issue. If necessary, adjust the firewall settings accordingly, considering security policies while enabling the required communication channels between the DMZ and local networks.

Here's a breakdown of the possibilities and some troubleshooting steps you can try:

Possible causes:

    Firewall rules: The Sangfor firewall might have inbound firewall rules blocking traffic from the local PC to the DMZ server.
    Routing: The routing configuration might not be directing traffic from the local PC to the DMZ server correctly.
    DNS resolution: If the local PC is trying to access the DMZ server by hostname, there might be issues with DNS resolution on the local network.
    IP addressing: The local PC and DMZ server might not be using compatible IP addresses or subnet masks.

Troubleshooting steps:

    Check firewall rules: Verify that there are no inbound firewall rules on the Sangfor firewall blocking traffic from the local PC's IP address or subnet to the DMZ server's IP address or subnet. You can check the firewall rules for the DMZ zone or create a specific rule allowing traffic from the local PC to the DMZ server.

    Verify routing: Ensure that the router connected to the local PC and the DMZ server is configured to route traffic between the two networks. This might involve checking routing tables or static routes if necessary.

    Test DNS resolution: Try pinging the DMZ server by its IP address instead of its hostname from the local PC. If the ping by IP address succeeds but not by hostname, there might be an issue with DNS resolution on the local network. Check the DNS settings on the local PC and the DNS server providing resolution for the local network.

    Confirm IP addressing: Make sure the local PC and DMZ server are using compatible IP addresses and subnet masks. They should be on the same subnet or have a route configured to reach each other's subnets.

    Additional checks:
        If you're using VLANs, ensure that the local PC and DMZ server are on the same VLAN or have proper VLAN tagging configured.
        Check for any temporary firewall rules or access control lists that might be blocking traffic.
        Consider consulting the Sangfor firewall documentation or contacting Sangfor support for further assistance.

Best solutions:

The best solution depends on the specific cause of the issue. However, here are some general recommendations:

    Start with the simplest solution first, such as checking firewall rules or DNS resolution.
    Make changes to the network configuration cautiously and document any changes made.
    Test your changes after making them to ensure they resolve the issue without causing any new problems.
    If you're unsure about any of the troubleshooting steps, consult a network administrator or Sangfor support for assistance.

Already solve for dmz to lan to wan and wan to lan can ping to local pc now