I can share my experience.
I'm running a very similar configuration; two connection servers with a security server in my DMZ paired to one of them, ASA5515-X between the security server in DMZ and the paired connection server / View desktop subnet.
I'm using Duo 2FA SaaS (which is fantastic by...