1. ) Bydefault all interfaces of ASA are pingable from their own security zone. so no need to specifically permit anything on these interface.
In case you have applied any access-list on Outside Interface then configure 'icmp permit any outside' (for your icmp testing). 'no' form of this command to disable the same. I could see that you have already enabled this command.
2.) For second requirement, you could perform Interface PAT on the Outside Interface for all your protected subnets.
statement could be like.
Step: create Objet network :
#object network obj-management77
#subnet <network> <mask>
#nat (management77,Outside) dynamic interface
#object network obj-Black
#subent <network><mask>
#nat(Black,Outside) dynamic interface
and so on for other protected networks.
Please use the link below to understand the same :
http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/nat_objects.html#pgfId-1455942
Note : Dynamic NAT is unidirectional in natrue. Connection could be only initiated from Protected Network to Outside Network. Any connection to Natted IP from Outside host wll be dropped.
3.) To permit tracerroute through ASA, please use the below link:
you could add :
Configure these inspections:
inspect icmp error
inspect icmp
Also change the change the 'icmp unreachable' command :
#no icmp unreachable rate-limit 1 burst-size 1
#icmp unreachable rate-limit 10 burst-size 5
configure Access-list :
#access-list outside-access-in extended permit icmp any any unreachable
#access-list outside-access-in extended permit icmp any any time-exceeded
http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html#trace
I hope this answers your query. If you have any other query , please let me know.
Thanks and Regards,
Akshay Rastogi
