The best way to see what the PIX is denying, or in otehr words, what the external server is sending, is to enable logging on the PIX. Set up a syslog server or do it via the console with the logging command (logging monitor debug) and then have the external server try a connection. You'll probably see a deny statement in the PIX syslog output, which will show you the protocol and port number that was sent. You can then allow that through the PIX if you're sure it's safe to do so.
