Routing – No Access to Cisco ESA from Different VLAN

To address your issue of not being able to get out to the Internet, you do not have an allow rule allowing 10.100.10.0/24 to 0.0.0.0/0. If you simply want to deny access to the 10.10.100.0/24 network from the 10.100.10.0/24 network, you want your access list to work like this (in this order):

1) Deny 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255 2) Permit 10.100.10.0 0.0.0.255 any

There's a few problems in your question. First, I wouldn't naturally think that I could get to the inside network from the outside network. The ASA is a FIREWALLL not a router. If it did this, it wouldn't be doing its job. A router will do that just fine.

The second major problem is with your route command. You don't need it. You have 2 locally connected networks. The firewall knows how to reach both of them. They are directly connected. Thus, you don't need a route command to tell the firewall what the next hop is.

With that stuff out of the way, let's get to an answer. The ASA requires every network to have a security level attached to it from 0-100. A higher security level will be able to access a lower security level. A lower security level needs explicit access granted to resources at a higher level. So let's start by assigning the proper security levels:

interface ethernet 0/0
nameif outside
security-level 0
ip address 10.19.200.3 255.255.255.0

interface ethernet 0/1
nameif inside
security-level 100
ip address 10.19.4.254 255.255.255.0

Now your inside network is allowed to access your outside network. If you need to allow your outside network to access your inside network, you need to define that in an access-list and assign it to the interface in an access group:

access-list outside_access_in extended permit ip any any
access-group outside_access_in in interface outside

But it's still not working? Probably because you need to define static mappings from one network to the other. Otherwise the firewall doesn't know what to do. Remember, this is a firewall, not a router:

static (inside,outside) 10.19.4.0 10.19.4.0 netmask 255.255.255.0
static (outside,inside) 10.19.200.0 10.19.200.0 netmask 255.255.255.0

That's it...you should have free flow between the 2 interfaces...really defeats the purpose of a firewall, but it seems to be what you want. At least it gives you a starting point and you can restrict traffic from there.