the configurable proxy pinging feature lets you control icmp access to pix firewall interfaces. this feature shields pix firewall interfaces from detection by users on an external network.

    we recommend that you grant permission for icmp unreachable message type (type 3).denying icmp unreachable messages, disables icmp path mtu discovery, which can halt ipsec and pptp traffic.