You need to implement this on the switch that has the VLAN67 interface, which is also the default-gateway for the subnet. If you have this running HSRP or VRRP, then implement it on all the switches with a VLAN67 interface.
Try the following which only denies PING, but allows other ICMP messages. If you want to deny all ICMP then leave out the second line, and remove the ‘echo’ from the first line. Change the number from ’100′ if you already have an access list with this number.
access-list 100 deny icmp any any echo
access-list 100 deny icmp any any echo-reply
access-list 100 permit ip any any</b>
On the Interface VLAN67
ip access-group 100 in
ip access-group 100 out</b>
Hope this helps.