Configure Cisco ASA 5510 Routing

I'm going to setup a front-end email server on the DMZ of the Cisco ASA 5510 firewall. I would like to ensure that there will be connection between the server on the DMZ and the mail server on the internal network. The mail server on the internal network is connected to a multilayer switch, Cisco 3560. The multilayer switch is connected to one of the interface of the Cisco ASA 5510 Firewall.

Your help is highly appreciated.

Firewall config:

ASA Version 8.0(2)
!
hostname firewall
domain-name domain.tld.bn
enable password 8Ry2YjxxxxRRXU24 encrypted
names
name 192.168.20.140 Domain-Whatever
name 192.168.20.72 Domain-webdevelopment
dns-guard
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address xxx.xxx.44.104 255.255.255.128
 ospf cost 10
!
interface Ethernet0/1
 nameif inside
 security-level 80
 ip address 192.168.20.1 255.255.255.0
 ospf cost 10
!
interface Ethernet0/2
 description Connection to MLS Switch
 nameif MLS
 security-level 100
 ip address 192.168.19.2 255.255.255.0
 ospf cost 10
!
interface Ethernet0/3
 description DMZ network segment
 nameif DMZ
 security-level 50
 ip address 192.168.110.253 255.255.255.0
 ospf cost 10
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
passwd 2KFQnbNIabcdeOU encrypted
boot system disk0:/asa802-k8.bin
ftp mode passive
clock timezone BNT 8
dns server-group DefaultDNS
 domain-name domain.tld.bn
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service domain-webservices tcp-udp
 port-object eq 110
 port-object eq 25
 port-object eq 443
 port-object eq domain
 port-object eq 21
 port-object eq www
 port-object eq 23
 port-object range 1352 1352
object-group service domain-whatever tcp-udp
 port-object range 48129 48137
 port-object range 8194 8198
 port-object range 8209 8220
 port-object range 8290 8294
object-group service Domino tcp
 description Ports for Domino Server
 port-object eq lotusnotes
 port-object range 1533 1533
object-group service DM_INLINE_TCP_3 tcp
 port-object eq lotusnotes
 port-object eq smtp
 port-object eq www
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service DM_INLINE_TCP_1 tcp
 port-object eq domain
 port-object eq www
 port-object eq https
object-group service DM_INLINE_TCP_2 tcp
 port-object eq lotusnotes
 port-object eq smtp
access-list inside_access_in extended permit tcp 192.168.20.0 255.255.255.0 any object-group domain-webservices
access-list inside_access_in extended permit udp 192.168.20.0 255.255.255.0 any object-group domain-webservices
access-list inside_access_in extended permit tcp host Domain-Whatever any object-group domain-whatever
access-list inside_access_in extended permit udp host Domain-Whatever any object-group domain-whatever
access-list csc-acl extended deny ip host 192.168.20.110 any
access-list csc-acl extended deny ip host 192.168.20.66 any
access-list csc-acl extended deny ip host 192.168.20.99 any
access-list csc-acl extended deny ip host 192.168.20.118 any
access-list csc-acl extended deny ip host 192.168.20.168 any
access-list csc-acl extended permit tcp any any eq www
access-list csc-acl extended permit tcp any any eq ftp
access-list csc-acl extended permit tcp any any eq pop3
access-list csc-acl extended permit tcp any any eq smtp
access-list DMZ_access_in extended permit ip any any
access-list MLS_access_in extended permit ip any any
access-list outside_access_in extended permit tcp any object-group DM_INLINE_TCP_3 host 202.160.44.104 log disable
!
tcp-map CLEAR_TSTAMP
  tcp-options timestamp clear
!
pager lines 24
logging enable
logging buffered debugging
logging asdm informational
logging class auth asdm emergencies
logging class ip asdm emergencies
logging class session asdm emergencies
mtu outside 1500
mtu inside 1500
mtu MLS 1500
mtu DMZ 1500
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip verify reverse-path interface MLS
ip verify reverse-path interface DMZ
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 33 interface
global (DMZ) 33 interface
nat (inside) 33 192.168.20.0 255.255.255.0
nat (DMZ) 33 192.168.110.20 255.255.255.255
static (DMZ,outside) tcp interface lotusnotes 192.168.110.20 lotusnotes netmask 255.255.255.255
static (DMZ,outside) tcp interface smtp 192.168.110.20 smtp netmask 255.255.255.255
static (DMZ,outside) tcp interface www 192.168.110.20 www netmask 255.255.255.255
static (DMZ,MLS) xxx.xxx.44.104 192.168.110.20 netmask 255.255.255.255
static (MLS,DMZ) 192.168.100.0 192.168.100.0 netmask 255.255.255.255
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group MLS_access_in in interface MLS
access-group DMZ_access_in in interface DMZ
route outside 0.0.0.0 0.0.0.0 202.160.44.1 1
route MLS 192.168.100.0 255.255.255.0 192.168.19.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.20.0 255.255.255.0 inside
http xxx.xx.136.226 255.255.255.255 outside
http xx.x.226.0 255.255.255.0 outside
http xx.x.227.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet 192.168.20.78 255.255.255.255 inside
telnet 192.168.20.168 255.255.255.255 inside
telnet timeout 10
ssh xx.x.226.0 255.255.255.0 outside
ssh xx.x.227.0 255.255.255.0 outside
ssh 192.168.20.168 255.255.255.255 inside
ssh 192.168.20.78 255.255.255.255 inside
ssh 192.168.20.110 255.255.255.255 inside
ssh timeout 20
ssh version 2
console timeout 5
management-access inside
threat-detection basic-threat
threat-detection statistics
!
class-map inspection_default
 match default-inspection-traffic
class-map csc-traffic
 match access-list csc-acl
class-map class-www
!
!
policy-map domain1-inside-policy
 class csc-traffic
  csc fail-close
policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
policy-map type inspect im domain-msn
 parameters
 match service chat conference file-transfer games voice-chat webcam
  drop-connection log
policy-map domain-inside-policy
 class csc-traffic
  csc fail-close
!
service-policy global_policy global
service-policy domain1-inside-policy interface inside
tftp-server inside 192.168.20.78 c:\tftp
username user1 password iNmExxxxxah9f7Rg encrypted privilege 0
username user2 password RmxLVuUrlsxxxxxF encrypted privilege 15
username user3.name3 password UzX0OkxxxxxP6kKW encrypted privilege 15
username user4 password DOan7bN0fAoxxxx7 encrypted privilege 15
prompt hostname context
Cryptochecksum:498f70f740a4ecac1296156fd8e35c29
: end
asdm image disk0:/asdm-602.bin
no asdm history enable


Multilayer Switch Config:

Switch#sh run
Building configuration...

Current configuration : 1841 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
no aaa new-model
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
!
interface GigabitEthernet0/6
!
interface GigabitEthernet0/7
!
interface GigabitEthernet0/8
!
interface GigabitEthernet0/9
!
interface GigabitEthernet0/10
!
interface GigabitEthernet0/11
!
interface GigabitEthernet0/12
!
interface GigabitEthernet0/13
!
interface GigabitEthernet0/14
!
interface GigabitEthernet0/15
!
interface GigabitEthernet0/16
!
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
!
interface GigabitEthernet0/19
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet0/20
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet0/21
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet0/22
 switchport access vlan 100
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
 no switchport
 ip address 192.168.19.1 255.255.255.0
!
interface GigabitEthernet0/25
!
interface GigabitEthernet0/26
!
interface GigabitEthernet0/27
!
interface GigabitEthernet0/28
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan100
 ip address 192.168.100.253 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.19.2
ip route 192.168.110.0 255.255.255.0 192.168.19.2
ip http server
!
!
!
control-plane
!
!
line con 0
line vty 5 15
!
end
Start Free Trial