Your nat and global commands are correct. I have a PIX 501 at home w/ the same commands. The icmp command applies to traffic terminating on the PIX's interface, where the access-list and conduit command applies to traffic passing through the PIX.http...

create an inbound access list with the following commands:access-list acl_inbound permit icmp any any echo-replyaccess-list acl_inbound permit icmp any any unreachableaccess-list acl_inbound permit icmp any any time-exceededaccess-group acl_inbound i...