ASA 5510 Config Help

Good Morning,
I'm looking for some assistance on setting up and locking down my ASA 5510 appliance. I have enclosed my running config below.  The ASA device is one of two appliances that i'm configuring for deployment.  I've purchased two SecurityPlus licenses and plan on configuring the two firewalls as an Active/Passive
setup.  I have the following services that need to be configured on the ASA device:

12.1xx.xxx.193 - Cisco 3800 router
12.1xx.xxx.199 - ASA Appliance
12.1xx.xxx.200 - Exchange Server 2 (SMTP)
12.1xx.xxx.201 - Citrix Access Gateway (DMZ, HTTPS Required only)
12.1xx.xxx.203 - External FTP Server (Passive)
12.1xx.xxx.204 - Outlook Web Access Only (Exchange server 1, HTTP & HTTPS Required)
12.1xx.xxx.206 - Outlook Web Access (Exchange server 2, HTTP & HTTPS Required)
HTTP & HTTPS OUT for inside interface

Is there a default deny on traffic generated from a lower security level (0) to a higher security level (100)?  And if so an ACL needs to be created to pass traffic, correct?

Also, if you could included any information on setting up an Active/Passive configuration.  Finally, I tried upgrading the firmware on the ASA to v7.22 from v7.0(6) and the ASDM to v5.22 from 5.06, however after upgrading the ASA to 7.11 the device went into a continous reboot loop.  Do I need to perform the 7.11 before the 7.22?

Thanks for all your help in advance!


Result of the command: "show run"

: Saved
:
ASA Version 7.0(6)
!
hostname asa
domain-name xxxxxxxxxxx.com
enable password xxxxxxxxxxxxxx encrypted
names
dns-guard
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 12.1xx.xxx.199 255.255.255.192
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.0.6 255.255.255.0
!
interface Ethernet0/2
 nameif dmz
 security-level 50
 ip address 172.20.1.1 255.255.255.0
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 management-only
!
passwd xxxxxxxxxxxxxxxx encrypted
banner exec *****************************************************
banner exec * * * *              W A R N I N G            * * * *
banner exec * * * *    THIS CONNECTION IS BEING LOGGED    * * * *
banner exec * * * *   UNAUTHORIZED ACCESS IS PROHIBITED   * * * *
banner exec *****************************************************
banner login *****************************************************
banner login * * * *              W A R N I N G            * * * *
banner login * * * *    THIS CONNECTION IS BEING LOGGED    * * * *
banner login * * * *   UNAUTHORIZED ACCESS IS PROHIBITED   * * * *
banner login *****************************************************
boot system disk0:/asa706-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
same-security-traffic permit inter-interface
access-list outside_access_in extended permit tcp any host 12.1xx.xxx.201 eq https
access-list outside_access_in extended permit tcp any host 12.1xx.xxx.200 eq smtp
access-list outside_access_in extended permit tcp any host 12.1xx.xxx.206 eq www
access-list outside_access_in extended permit tcp any host 12.1xx.xxx.206 eq https
access-list outside_access_in extended permit tcp any host 12.1xx.xxx.204 eq www
access-list outside_access_in extended permit tcp any host 12.1xx.xxx.204 eq https
access-list outside_access_in extended permit tcp any eq www 12.146.90.0 255.255.254.0 eq www
access-list outside_access_in extended permit tcp host 12.1xx.xxx.203 12.146.90.0 255.255.254.0
access-list outside_access_in extended permit tcp any 12.146.90.0 255.255.254.0 eq https
pager lines 24
logging enable
logging timestamp
logging standby
logging asdm informational
logging facility 22
logging device-id hostname
logging host inside 192.168.0.58
logging permit-hostdown
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
asdm image disk0:/asdm506.bin
asdm history enable
arp timeout 14400
global (outside) 10 12.1xx.xxx.207-12.1xx.xxx.212 netmask 255.255.255.192
nat (inside) 10 0.0.0.0 0.0.0.0
static (inside,outside) 12.1xx.xxx.204 192.168.0.5 netmask 255.255.255.255
static (inside,outside) 12.1xx.xxx.206 192.168.0.56 netmask 255.255.255.255
static (inside,outside) 12.1xx.xxx.200 192.168.0.36 netmask 255.255.255.255
static (dmz,outside) 12.1xx.xxx.201 172.20.1.3 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 12.1xx.xxx.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
username test password xxxxxxxxxxxxxxxx encrypted privilege 15
http server enable
http 192.168.0.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.0.0 255.255.255.0 inside
telnet 192.168.1.0 255.255.255.0 management
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcpd address 192.168.0.2-192.168.0.3 inside
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
dhcpd enable management
ntp authenticate
ntp server 128.118.25.12 source outside prefer
Cryptochecksum:2f6ebf6f42b1e7d1d3eab9c139e19384
: end
Start Free Trial