denies not working

[ericw]

I have set up explicit denies for tcp/udp ports 1067 and 1068 using the conduit command. My syslog is still showing that connections are being made. What did I miss?

[jackko]

conduit works in order, please verify if there is any conduit before would have permit the traffic

also acl will take in action before any conduit, please verify it there is any acl being applied

perhaps post the config

[ericw]

Below are the top 4 conduit listed they are also the ones in question that I keep seeing connections to.

conduit deny tcp any eq 1067 any

conduit deny udp any eq 1067 any

conduit deny tcp any eq 1068 any

conduit deny udp any eq 1068 any

I have the following acl's setup:

access-list 101 permit ip 10.0.0.0 255.0.0.0 192.168.2.0 255.255.255.0

access-list out_in deny tcp any eg ftp

access-list out_in deny tcp any eg 1067

access-list out_in deny udp any eg 1067

access-list out_in deny tcp any eg 1068

access-list out_in deny udp any eg 1068

I don't understand.