Outbound port blocked - PIX 501

[mufka]

I have inherited a PIX 501 6.3(5) with a pretty simple setup. It only has one access list and it permits traffic between a main site and a remote site over VPN.
For some reason, TCP 1600 doesn't seem to be allowed out (trying to access an outside host on port 1600). There is no access list preventing this traffic, but something is preventing it. If I plug in outside the firewall, I have no problem. I also setup another 501 with just a base config and it worked ok.
Here is the config (which I have not cleaned up at all yet):

PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 90 permit ip 10.0.0.0 255.0.0.0 192.168.100.0 255.255.255.0 
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 6x.x.x.2 255.255.255.224
ip address inside 10.0.0.1 255.0.0.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 90
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 6x.x.x.3 10.0.0.2 netmask 255.255.255.255 0 0 
static (inside,outside) 6x.x.x.5 10.0.0.4 netmask 255.255.255.255 0 0 
static (inside,outside) 6x.x.x.4 10.0.0.3 netmask 255.255.255.255 0 0 
conduit permit tcp host 6x.x.x.3 eq smtp any 
conduit permit tcp host 6x.x.x.3 eq [URL unfurl="true"]www any[/URL] 
conduit permit tcp host 6x.x.x.3 eq ident any 
conduit permit tcp host 6x.x.x.4 eq [URL unfurl="true"]www any[/URL] 
conduit permit tcp host 6x.x.x.4 eq ident any 
conduit permit tcp host 6x.x.x.4 eq https any 
conduit permit tcp host 6x.x.x.4 eq smtp any 
conduit permit tcp host 6x.x.x.5 eq [URL unfurl="true"]www any[/URL] 
conduit permit tcp host 6x.x.x.5 eq ident any 
conduit permit tcp host 6x.x.x.5 eq https any 
conduit permit tcp host 6x.x.x.5 eq smtp any 
rip inside passive version 1
route outside 0.0.0.0 0.0.0.0 6x.x.x.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server TACACS+ max-failed-attempts 3 
aaa-server TACACS+ deadtime 10 
aaa-server RADIUS protocol radius 
aaa-server RADIUS max-failed-attempts 3 
aaa-server RADIUS deadtime 10 
aaa-server LOCAL protocol local 
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set strong esp-3des esp-sha-hmac 
crypto map officevpn 20 ipsec-isakmp
crypto map officevpn 20 match address 90
crypto map officevpn 20 set peer 1x.x.x.9
crypto map officevpn 20 set transform-set strong
crypto map officevpn interface outside
isakmp enable outside
isakmp key xxxxxx address 1x.x.x.9 netmask 255.255.255.255 
isakmp policy 9 authentication pre-share
isakmp policy 9 encryption 3des
isakmp policy 9 hash sha
isakmp policy 9 group 1
isakmp policy 9 lifetime 86400
ssh timeout 5
console timeout 0
terminal width 80

 

[Supergrrover]

Conduits and ACLs don't mix. Other than that, check your ISP for filtering.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[mufka]

Not the ISP. I have no problem outside the firewall. I've been working on this some more. When I had tried it on another PIX 501, and got it to work, the IOS was 6.1. When I updated that one to 6.3(5) I have the same problem. This is with no access lists. This rules out the conduit conflict. Looks like there is something in 6.3(5) that is causing the problem.

 

[mufka]

It turns out that the problem was with the ftp fixup protocol. I don't know why this is, the vendor told me that the only ports required were 80 and 1600. Is it a good idea to disable the ftp fixup?