Ben,
You don’t specify if the ports you want opening are inbound or outbound. If you want clients connecting from the outside to say port 25 (SMTP) for email, what you’ll need is an outside interface ACL and a static translation rule.
Ex:
access-list permit tcp any host eq smtp
access-group in interface outside
static (inside,outside) tcp smtp smtp netmask 255.255.255.255 0 0
By default the pix will allow all outbound connectivity, i.e. higher interface to lower interface.
But if you want to filter who goes out from your internal network, i.e. say you only wanted specific internal users to access the internet.
Ex.
access-list inside permit tcp host any www
access-list inside deny tcp any any eq www
access-list inside permit ip any any
access-group inside in interface inside
Hope this helps and let me know if you need further assistance. Please rate all post so that it may help others.
Jay
