Giuseppe thanks for your urgent reply,

I tried to add static routes for my internal network and default route for Internet but it shows me error message (inconsistent address and mask)

My Switch port attached with ASA 192.168.20.2

ASA port attached with switch 192.168.20.1

DMZ interface on ASA 192.168.1.18

servers are on DMZ

servers ip address range (192.168.1.4-15)

Outside interface on ASA connected with cisco 2811 router 192.168.74.2

Cisco 2811 router connected wit ASA 192.168.74.1

Vlans are configured on switch 2-10

vlan 2 ip address 192.168.2.1

vlan 3 ip address 192.168.3.1

and so on

when I add a static route on switch

ip route 192.168.1.18 255.255.255.0 192.168.20.1

it shows me a error message (inconsistent address and mask)

Please advise

Regards,

Junaid

The mask is inconsistent- are you trying to add a route for a single host, or the subnet?

try ip route 192.168.1.0 255.255.255.0 192.168.20.1

The switch was confused because in you route statement you've mentioned two different things- point the route for a particular host (192.168.1.18) with a subnet mask indicating a /24 - 255.255.255.0

You want to either point everything starting with 192.168.1.x towards this route (use a 255.255.255.0 mask) or just the single address 192.168.1.18 (255.255.255.255) towards this next hop.

I'd revisit your dual-attached interenet strategy and describe what it is you're trying to accomplish. You're going to load balance connections through the ASA and the DSL connection to the internet, and the ASA isn't going to be happy about it.

Some traffic will start by establishing a connection to the DSL router, and get a NATed address- then the next packet in this conversation might go out the ASA. Two things are going to happen:

The ASA is going to think, "I don't have this connection in my table. Drop the packet."

Even if the ASA did let the packet out, your 2811 would then NAT the packet and send it out to the destination- but now the recieving web page isn't going to realize that this packet (with a different NAT address) is any way related to your other session- and stuff is going to break and get really miserable.

If you have a valid need for the DSL router, you need to figure out what it is, and set up some sort of policy route for it.

If the goal is a 'backup connection', then I'd move it outside the ASA, and set up policy routing on the ASA to pick one, then the other.

If the goal is something else... you've got your work cut out for you. :)