When working with ICMP, remember that the [icmp] command is used to affect ICMP messages to the pix as a host while the [access-list] command is used to affect ICMP messages traversing the Pix.
If you're using IPSec tunnels throught the Pix, you may want to consider letting in fragment chain sizes of 2. IPSec creates enough overhead to cause a lot of packets to be fragmented. MTU path discovery would prevent this, but many networks prevent the inbound requests that allow the discovery to work. For this same reason, you may also want to consider allowing the Pix to receive unreachables on your inside hosts behalf if you the Pix will terminate VPN tunnels. [icmp permt any unreachables outside]
Floodguard is enabled by default and doesn't need to be enabled. It shouldn't be needed on a lightly loaded network, but it would be needed in times of a DoS attack if you're Pix does authentication "uauth" of traffic entering or leaving the network.
If you're interested, the Pix can authenticate users on the inside before allowing the traffic to leave using RADIUS. This is helpful in situations such as a web server on the inside is hacked from the outside. By enforcing authentication for other traffic to leave, the options to the offending hosts are severely limited. A timeout is used to trigger authentication again after a specified time. The [floodguard] is used to protect this "uauth" feature of the Pix.
The Pix has VERY BASIC IDS signatures built-in that you may want to enable using the [ ip audit ] command set.
Enable SSH for authentication and encryption by generating an RSA key and saving it to flash. [ca generate rsa key 1024] and [ca save all] Disable telnet by removing any [telnet] commands and replace them with [ssh]. [http] should also be restricted as much as possible for administration.
