It seems to me, after a lot of testing, that regardless of ACLs and ICMP settings, you cannot ping a firewalled vlan interface on a FWSM through another interface.
In other words, let's say I have a layer 3 switch connected via a trunk to the switch with the FWSM:
Switch 1 Switch 2 with FWSM
Vlan10 10.100.66.1 --------> Vlan10 10.100.66.4 ---------> Vlan99 192.168.20.1
If icmp is enabled on both vlan10 and 99 on the FWSM, switch one can ping 10.100.66.4, but it will not be able to ping 192.168.20.1, even if that interface has a totally permissive access list, is set to security 100, and has icmp enabled.
I will also not be able to do
ping Vlan99 10.100.66.1
from the FWSM--in other words, I cannot ping from the interface through another interface on the FWSM.
I tried to add "inspect icmp" under the global MPF, but that didn't change anything.
Am I correct in my assumptions here?
Also, as a side note, I noticed that unsuccessful pings from the FWSM always yield "?????" results, even if it is not a routing problem--is this correct?
