PIX 515, how i can prevent outbound connections?

[DSOFT]

Hi:

I have a PIX 515 and i think that the PIX have open all ports for outbound connections, (i have ALIAS and STATIC and some CONDUITS commands)how i can DENY outbound connections for some TCP or UDP ports? Ie: ICQ, MSN?

Thanks

 

[cissp2002]

Access-lists are your best option here. There used to be outbound commands that restricted outbound access for certain protocols but now it is done with access-lists.
Ex:access-list acl-inside deny tcp any any eq icmp
access-list acl-inside deny tcp any any eq 110
access-list acl-inside permit ip any any
Then to apply it is a little tricky:

access-group acl-inside in interface inside

Because the PIX lets everything out by default you have to apply the ACL to the inside interface coming back in.

Hope this helped!