With your configuration, from 10/8 and 170.x.x/24 you should be able to ping the external interface of the PIX. If you cannot ping that from a client on those networks, but can from the 7513, then there is probably a routing problem on the 7513.
From the pix, can you ping the router to the internet? The ip you should be trying to ping from the pix is the ip in the route outside command statement.
1. Conduits and ACLs should not be used concurrently. Not that I think this is your problem. You should replace your conduit for ICMP into ACLs.
2. You CANNOT ping a Pix's interface accept from the same attached interface. In otherwords, you'll never be able to ping the Pix's outside interface from inside. Or ping the Pix's inside interface from outside. You can only ping the inside interface from inside. etc. This is normal and not a symptom of your problem.
Since you can ping the Pix's internal interface from you 10.x.x.x clients, can you ping the inside interface of your external router? If not this is where the problem lies.
I can't tell the subnets we're dealing with here due to the doctoring of the IPs, but make sure that your external router knows that it needs to route the traffic of your NAT pool to the Pix. This should only be necessary however if the NAT pools are not on the same subnet of the Pix's outside interface. This test would tell more if you temporarily removed the NAT 0 statement or used a [static] that mapped one of your internal clients to an IP in the same subnet as your NAT pool.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...