Just to give you idea how ASA work. It allow all traffic from higher security level to lower security level. This is by default you don't have to configure anything for this.
So in your scenario
Inside (100) to Outside (0)
Inside (100) to DMZ (50)
DMZ (50) to Outside (100)
This traffic flows are allowed by default. ASA is a statefull firewall so it allows the return traffic. By default all TCP and UDP packets are inspected. If you want ping to work through firewall you need to enable ICMP inspection bye below command.
Fixup protocol ICMP
The traffic going on the outside or say internet and return back you need to additional configuration of default route and NAT. Any device must know where to send the packet for particular ip/subnet, for this it relies on route table. The connected interface subnet are always there for Inside and DMZ however to go to internet to any ip/subnet you need default route. The traffic going over the internet should have public routeable IP so you need to NAT your Inside and DMZ private IP addresses to public IP address when it goes to internet through Outside interface.
For Route
route OUTSIDE 0 0 1.1.1.1
where 1.1.1.1 is ISP gateway.
For NAT
Object network LAN
subnet 10.10.10.0 255.255.255.0
nat (inside,outside) dynamic interface
***This is for inside to outside***
Object network DMZ
subnet 192.168.10.0 255.255.255.0
nat (dmz,outside) dynamic interface
***This is for DMZ to outside***
All the above hope to answer your first 3 questions.
Now for the 4th question you need to allow access from lower to higher security level
Outside (0) to inside (100)
To do this you required to configure ACL. And to add over to this you also require NAT (a public IP) as you want your server to be accessible over the internet.
For NAT web server
Object network web-server
Host 10.10.10.10
nat(inside,outside) source static 1.1.1.2
For ACL to allow traffic
Access-list Outside_in extended permit TCP any host 10.10.10.10 EQ 443
*** CREATE ACL***
Access-group Outside_in in interface OUTSIDE
*** APPLY TO AN INTERFACE***
The ACL will block all other traffic as there is explicit deny any any at the end by default.
You will use private ip of the web-server in ACL.
I hope this answers all your queries. Feel free to contact for more details.
Ref link for NAT
https://www.practicalnetworking.net/stand-alone/cisco-asa-nat/#staticnatI would request you to verify the command syntax as I am directly typing over mobile. However you will have good idea for your scenario.
HTH
### RATE ALL HELPFUL RESPONSES ###
