More on routing:
{internet} - [Firewall A] - DMZ Web servers 10.1.1/24 - [Firewall B] - DBs and Users 192.168.1/24
Firewall A also needs a route to the inner subnet, not just the DMZ servers. That's if Firewall B is not using NAT -- it typically would not be. If Firewall B is using NAT, however, then the inner subnet's traffic is all translated into Firewall B's address on the 10.1.1 network.
Isn't networking fun? There are so many things to misconfigure.