Quote Originally Posted by Net2Infinity
I would look at your access-lists to see what traffic you are allowing from the outside interface to the DMZ. Sounds like you are allowing all ICMP inbound.
actually we aren't. We have some Fixup rules on the firewall that make it look like the balancer has ports open but in reality it doesn't. I've gone through all of the ACLs and no ICMP is allowed inbound. The PIX is reporting it to the internal IP simply because it is a NAT'd address for the same box... no traffic is really making it there.

That was one of the first things I was worried about also. ICMP inbound = bad.