Cisco – How to statically configure DNS servers on a Cisco router when the WAN interface uses DHCP

It looks like you have your AP using vlan ID 3 as its native vlan (untagged), while your router is using the default vlan 1 as its native vlan. Create a vlan 1 on your AP as the native vlan and this should correct this behavior.

There's a few problems in your question. First, I wouldn't naturally think that I could get to the inside network from the outside network. The ASA is a FIREWALLL not a router. If it did this, it wouldn't be doing its job. A router will do that just fine.

The second major problem is with your route command. You don't need it. You have 2 locally connected networks. The firewall knows how to reach both of them. They are directly connected. Thus, you don't need a route command to tell the firewall what the next hop is.

With that stuff out of the way, let's get to an answer. The ASA requires every network to have a security level attached to it from 0-100. A higher security level will be able to access a lower security level. A lower security level needs explicit access granted to resources at a higher level. So let's start by assigning the proper security levels:

interface ethernet 0/0
nameif outside
security-level 0
ip address 10.19.200.3 255.255.255.0

interface ethernet 0/1
nameif inside
security-level 100
ip address 10.19.4.254 255.255.255.0

Now your inside network is allowed to access your outside network. If you need to allow your outside network to access your inside network, you need to define that in an access-list and assign it to the interface in an access group:

access-list outside_access_in extended permit ip any any
access-group outside_access_in in interface outside

But it's still not working? Probably because you need to define static mappings from one network to the other. Otherwise the firewall doesn't know what to do. Remember, this is a firewall, not a router:

static (inside,outside) 10.19.4.0 10.19.4.0 netmask 255.255.255.0
static (outside,inside) 10.19.200.0 10.19.200.0 netmask 255.255.255.0

That's it...you should have free flow between the 2 interfaces...really defeats the purpose of a firewall, but it seems to be what you want. At least it gives you a starting point and you can restrict traffic from there.