I have an ASA5510 in use that I have set up to block pings on the outside interfaces using 'icmp deny any Outside' and 'icmp deny any backup'. Currently, I simply have a secondary route with a higher metric that points out our backup connection. The problem with that being it seems to only work if the physical link on the promary goes down, so I was was going to implement a SLA setup that would monitor the gateway on the other end of our main connection, and if that became unreachable, traffic would automatically route out our backup. The problem is, before I set up the SLA, I tried pinging the gateway and found I couldn't. I have ICMP inspect turned on, so from inside, pings work as expected, but from the ASA itsself, pings to the outside world fail. Through testing, I found that it's the icmp deny command I have set up that's causing it to fail. When I disabled it, I was able to ping the gateway, but of course, then the ASA would respond to pings on its outside interface.
I tried adding 'icmp permit host {outside IP} Outside', and making sure that it was above the deny command, but that didn't work.
Is there a command that I'm missing (or have forgotten) that will prevent the ASA from replying to pings on its outside interfaces, but will allow the ASA itsself to ping out, thus allowing me to set up the SLA?
