You need to add icmp to the allowed traffic from "self to out-zone" (out-zone being the external interface. In the CCP GUI it will look something like this:
That translates to CLI configuration lines similar to the following (only directly relevant commands included here):
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
inspect
class class-default
pass
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply
interface GigabitEthernet0/1
description $FW_OUTSIDE$
zone-member security out-zone
