ICMP outbound packets are allowed by default, but inbound packets (replies) are blocked. To enable: policy-map global_policy class inspection_default inspect icmp