PIX 515e port question 1

[hrswift]

Since by nature the PIX ports are all closed and must be opened if needed is there any reason these statements are necessary?

object-group service denytcp tcp
port-object range 3127 3198
port-object eq pop2
port-object eq irc
port-object eq 37
port-object eq 81
port-object eq 123
port-object eq 220
port-object eq 1214


There are many more I just listed a few....

 

[KiscoKid]

Yeh does seem kind of pointless. As you say, you typically allow what you want through and not what you want to deny.

It may be the original creator of this access policy did it so he could audit how much traffic was getting denied, i.e. I think you're able to inspect the access list and see total matches against the deny statements which is useful to understand what kind of unwanted traffic is hitting your PIX.