"But why do i have to do this for icmp traffic compare to other tcp traffic? Thks in advance"
Do you mean
1) allow it back in with an access-list
OR
2) enable icmp inspection
With a standard TCP connection a stateful firewall uses the TCP Flags + sequence numbers to keep track of state.
Now some TCP applications are not standard - FTP being a good example. So extra bits of code are added to the firewall to cope with these non-standard applications. Without these extra bits of code the normal stateful code of the a firewall would not be able to adequately secure these applications. These extra bits of code used to be called fixups and are now called inspections.
But ICMP does not have sequence numbers or TCP flags so there is nothing for it to keep track of in that respect. So just like the non-standard TCP code an extra bit of code has been written for ICMP. Note that this is new to the v7.x versions of code. Version 6.x of pix software did not have this.
If you don't want to use the inspection code for ICMP you can do it the old way ie. with ICMP because it is not stateful you need to allow it both ways through the firewall with access-lists.
Jon
