fwsm на cisco 6500.

cisco65:

cisco6500-test#sh firewall vlan
Display vlan-groups created by both ACE module and Firewall

Group    Created by      vlans
-----    ----------      -----
    1      Firewall      103,144

fwsm:

: Saved
:
FWSM Version 4.1(1)
!
hostname FWSM
enable password ююю encrypted
names
dns-guard
!
interface Vlan103
nameif outside
security-level 0
ip address 190.90.70.100 255.255.255.0
!
interface Vlan144
nameif inside
security-level 100
ip address 192.168.144.1 255.255.255.0
!
passwd ююю encrypted
no ftp mode passive
access-list icmp extended permit icmp any any
access-list icmp extended permit ip any any
pager lines 24
logging enable
logging monitor debugging
mtu outside 1500
mtu inside 1500
ip verify reverse-path interface outside
no failover
no asdm history enable
arp timeout 14400
nat-control
nat (inside) 1 192.168.144.0 255.255.255.0
access-group icmp in interface outside
access-group icmp in interface inside
route outside 0.0.0.0 0.0.0.0 190.90.70.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 1:00:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-invite 0:03:00 sip-disconnect 0:02:00
timeout pptp-gre 0:02:00
timeout uauth 0:05:00 absolute
username admin password ююю encrypted privilege 15
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
service reset no-connection
no service reset connection marked-for-deletion
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect skinny
  inspect smtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:ююю
: end

При таких настройках подключен хост 192.168.144.5 и он не пингует fwsm (192.168.144.1)
Включаю logging monitor debug и terminal monitor получаю сообщение:
%FWSM-3-313001: Denied ICMP type=8, code=0 from 192.168.144.5 on interface inside
на каждый посланный пинг.

Если пингую с fwsm на хост 192.168.144.5, то до хоста пинги доходят и он отправляет ответ, но всёравно ответы не доходят:
FWSM(config)# ping 192.168.144.5
Sending 5, 100-byte ICMP Echos to 192.168.144.5, timeout is 2 seconds:
%FWSM-3-313001: Denied ICMP type=0, code=0 from 192.168.144.5 on interface inside
%FWSM-3-313001: Denied ICMP type=0, code=0 from 192.168.144.5 on interface inside
%FWSM-3-313001: Denied ICMP type=0, code=0 from 192.168.144.5 on interface inside
%FWSM-3-313001: Denied ICMP type=0, code=0 from 192.168.144.5 on interface inside
%FWSM-3-313001: Denied ICMP type=0, code=0 from 192.168.144.5 on interface inside
?
Success rate is 0 percent (0/5)
%FWSM-5-111008: User 'enable_15' executed the 'ping 192.168.144.5' command.
FWSM(config)#

команда deb icmp trace -абсолютно пустая:

FWSM(config)# debug icmp trace
debug icmp trace enabled at level 1
%FWSM-5-111008: User 'enable_15' executed the 'debug icmp trace' command.
FWSM(config)#

IOS сменил с 3.2 на 4.1, не помогло. Если с fwsm по tftp копирую конфиг или ios - всё работает, nat не работает (но идут другие ошибки), обо всём могу подробней, но самое простое - пинги, в чем у меня ошибка или может быть сам модуль fwsm не рабочий или наоборот пакеты рубит c65?