Permit Ping, Traceroute and MTR through ASA
Permit ICMP
If you have an access-group applied to your outside interface already, use the name for the acccess-list that you are currently using in place of OUTSIDE_ACCESS_IN
access-list OUTSIDE_ACCESS_IN extended permit icmp any any access-group OUTSIDE_ACCESS_IN in interface OUTSIDE icmp permit any INSIDE
Permit MTR or Traceroute
Complete the above for ICMP and add the follwing:
class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp
Reference: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml#topic0
the above document references IOS 7, but the instructions work for versions 8 and 9
You get the error message ERROR: % class-map inspection_default not configured
You did not execute the commands
class-map inspection_default match default-inspection-traffic