Still does not work. This is what shows in the logs.Can you call or email me off the boards4Jul 22 201019:01:10106023208.85.196.732233192.168.11.2443Deny tcp src outside:1.1.1.1./2233 dst inside:192.168.11.2/443 by access-group "outside_access_in" [0...

message removed

They actually test agains tthe firewall. So i'm assuming they just need icmp on the outside inteface turned on.

Thanks! I'm going to test this now. How do I allow a range of Ip's to hit our firewall for PCI testing. A security company we use needs to be able to hit the firewall to test. In our Watchguard this was called an exception list.