Hi,

It's all to do with where you are pinging from.with regard to the ASA,as it is a Firewall then you want to control responses.

looking at it from the ASA point of view.

icmp permit any echo inside command allows devices on the inside network to ping the ASA and the ASA will reply. But it will not allow the ASA to ping the inside devices as we are not allowing echo-replies, so when you ping an inside device from the ASA the reply is dropped.

that's why you need the icmp permit any echo-reply inside, that will allow the reply from the ping from the ASA to the inside device to be received by the ASA.

Perhaps a look at the outside interface would be better.On the ASAs Public interface you don't want it to respond to Pings from the Internet, but you might want to ping the internet from the ASA, so in this case you would just have the icmp permit any echo-reply outside command,

so the ASA would allow replies to its own pings to devices on the Internet. but would not allow Internet devices to ping the ASA.

HTH

Richard.