From outside segment, you definitely cannot ping ASA inside interface IP (10.1.1.1 - vlan101). This is the default settings/rules of firewall. You can only ping directly connected interface to a segment where you initiate the ping.
But you should be able to ping inside host of 10.1.1.12 if you set no nat/translation. In this case, you should have something like:
static (vlan101,outside) 10.1.1.0 10.1.1.0 netmask 255.255.255.0
static (vlan102,outside) 10.1.2.0 10.1.2.0 netmask 255.255.255.0
The above static commands allows your outside hosts to talk to inside hosts (without any translation) using their original IPs (vlan 101 & 102).
Also, make sure all machines in Vlan101 and Vlan102 used 10.1.1.1 & 10.1.2.1 as their respective gateways.
Other than that, routing on ASA should be as follow:
route outside 0.0.0.0 0.0.0.0 10.1.3.x ---> vlan interface IP on switch-side connected to ASA outside interface/port.
On switch side, make sure the routing point to ASA outside interface IP, as follow:
ip route 10.1.1.0 255.255.255.0 10.1.3.9
ip route 10.1.2.0 255.255.255.0 10.1.3.9
*Optional - if your inside hosts (from vlan 101 or 102) still unable to access outside hosts, try adding ACL and appliy in their respective interface:
access-list vlan101-to-outside permit icmp any any
access-list vlan101-to-outside permit tcp any any
access-list vlan101-to-outside permit udp any any ---> can also use 'ip' to replace tcp & udp keyword
access-group vlan101-to-outside in interface vlan101
access-list vlan102-to-outside permit icmp any any
access-list vlan102-to-outside permit tcp any any
access-list vlan102-to-outside permit udp any any ---> can also use 'ip' to replace tcp & udp keyword
access-group vlan102-to-outside in interface vlan101
*PIX/ASA will automatically add 'extended' keyword to the ACL.
For your outside ACL, modify it to:
access-list outside-01 extended permit icmp any any log
access-list outside-01 extended permit tcp any any log
access-list outside-01 extended permit udp any any log ---> can also use 'ip' to replace tcp & udp keyword
access-group outside-01 in interface outside
For any ACLs, you can narrow access by permitting whatever necessary TCP/UDPO ports, and deny all other using 'access-list XXXX deny ip any any'
BTW, do you need to allow Vlan101 and Vlan102 to talk to each other? Use "same-security-traffic permit inter-interface" command. Add subnet static mapping between them:
static (vlan101,vlan102) 10.1.1.0 10.1.1.0 netmask 255.255.255.0
static (vlan102,vlan101) 10.1.2.0 10.1.2.0 netmask 255.255.255.0
http://www.cisco.com/en/US/partner/products/ps6120/products_command_reference_chapter09186a00805fb9eb.html
HTH
AK
