Unblocking Ports in Cisco Pix Firewalls

If you're trying to allow inbound connections to the Barracuda via the PIX, the configuration commands are as follows:

access-list outside_in permit tcp 8000 interface outside eq 8000
static (inside,outside) tcp interface 8000 x.x.x.x 8000 netmask 255.255.255.255

Replace outside_in with the name of the access list assigned to the outside interface and x.x.x.x with the inside IP address of the Barracuda.

This assumes that you're trying to forward port 8000/tcp *inbound* from the outside interface address of the PIX.  If you need help with *outbound* port 8000/tcp rather than inbound or you're trying to forward via a different outside IP address, please let me know.

Thanks for the comments, and yes I need to let the barracuda connect with the outside, so I have to allow its outgoing connections through port 8000.

Okay, that's a different proposal.  By default, the ASA units allow traffic to flow from the inside to the outside unhindered...  but access-lists and NAT configurations can get in the way of that depending on how it's set up.  Can you post a scrubbed copy of your configuration?  If so, I can have a look to see if anything is off-kilter.

Im assuming everything else works OK? if so connect to the firewall either by SSH/Telnet or Console Cable http://www.petenetlive.com/Tech/Firewalls/Cisco/connect2.htm

Log in and go to enable mode

Sent username "pix"
Type help or '?' for a list of available commands.
PetesASA>
PetesASA> en
Password: ********
PetesASA#

Find which access lists are applied to your interfaces

PetesASA# show run access-group
access-group inbound in interface outside
access-group outbound in interface inside
PetesASA#

In the example above mines called "outbound" take a note of what yours is called - enter configure terminal mode and create a new ACL

PetesASA#conf t
PetesASA(config)#access-list outboung extended permit tcp host {IP of the Barracuda} any eq 8000

replace outbound with the name of your outbound ACL

Then save your hard work

PetesASA(config)# write mem
Building configuration...
Cryptochecksum: 5637635e 5b779584 14aca2f2 f4f28896
7370 bytes copied in 1.740 secs (7370 bytes/sec)
[OK]
PetesASA(config)#

Job done

Here's my Pix config, how can I add unblock the barracuda on outgoing and ingoing requests through port 8000 without affecting my current settings?

PIX Version 4.4(8)
nameif ethernet0 outside security0

 nameif ethernet1 inside security100

 nameif ethernet2 iis_verizon security10

 nameif ethernet3 conexion_verizon security15

 nameif ethernet4 prueba security25

nameif ethernet5 broadband security1

 enable password 4eLl3pI24tp5EUBK encrypted

 passwd 4eLl3pI24tp5EUBK encrypted

 hostname pixfirewall

 fixup protocol ftp 21

 fixup protocol http 80

 fixup protocol h323 1720

 fixup protocol rsh 514

 fixup protocol smtp 25

 no fixup protocol sqlnet 1521

 names
 pager lines 24

 no logging on

 interface ethernet0 auto

 interface ethernet1 auto

 interface ethernet2 auto

 interface ethernet3 auto

 interface ethernet4 auto

 interface ethernet5 auto

 mtu outside 1500

 mtu inside 1500

 mtu iis_verizon 1500

 mtu conexion_verizon 1500

 mtu prueba 1500

 mtu broadband 1500

 ip address outside 190.3.79.90 255.255.255.248

 ip address inside 172.16.20.1 255.255.0.0

 ip address iis_verizon 127.0.0.1 255.255.255.255

 ip address conexion_verizon 127.0.0.1 255.255.255.255

 ip address prueba 127.0.0.1 255.255.255.255

 ip address broadband 100.88.113.146 255.255.255.240

 no failover
 failover timeout 0:00:00

 failover ip address outside 0.0.0.0

 failover ip address inside 0.0.0.0

 failover ip address iis_verizon 0.0.0.0

 failover ip address conexion_verizon 0.0.0.0

 failover ip address prueba 0.0.0.0

 failover ip address broadband 0.0.0.0

 arp timeout 14400
 nat (inside) 1 0.0.0.0 0.0.0.0 0 0

 nat (broadband) 2 0.0.0.0 0.0.0.0 0 0

 static (inside,outside) 190.3.79.92 172.16.20.98 netmask 255.255.255.255 0 0

 static (inside,outside) 190.3.79.93 172.16.20.102 netmask 255.255.255.255 0 0

 static (inside,outside) 190.3.79.94 172.16.20.80 netmask 255.255.255.255 0 0

 static (inside,outside) 190.3.79.91 172.16.20.99 netmask 255.255.255.255 0 0

 static (inside,broadband) 100.88.113.147 172.16.20.99 netmask 255.255.255.255 0 0

 conduit permit tcp host 190.3.79.91 eq www any

 conduit permit tcp host 190.3.79.93 eq www any

 conduit permit tcp host 190.3.79.93 eq 443 any

 conduit permit tcp host 190.3.79.94 eq pop3 any

 conduit permit tcp host 190.3.79.94 eq smtp any

 conduit permit tcp host 190.3.79.94 eq www any

 conduit permit tcp host 190.3.79.92 eq 3000 any

 conduit permit tcp host 190.3.79.92 eq ftp any

 conduit permit tcp host 190.3.79.92 eq smtp any

 conduit permit tcp host 190.3.79.92 eq pop3 any

 conduit permit tcp host 190.3.79.92 eq pop2 any

 conduit permit tcp host 172.16.20.80 eq smtp host 172.16.20.98

 conduit permit tcp host 172.16.20.80 eq pop3 host 172.16.20.98

 conduit permit tcp host 172.16.20.98 eq smtp host 172.16.20.80

 conduit permit tcp host 172.16.20.98 eq pop3 host 172.16.20.80

 conduit permit tcp host 172.16.20.99 eq www any

 conduit permit tcp host 200.88.113.147 eq www any

 conduit permit tcp host 172.16.20.98 eq 443 any

 conduit permit tcp host 190.3.79.92 eq 443 any

 conduit permit tcp host 190.3.79.92 eq 995 any

 conduit permit tcp host 172.16.20.98 eq 995 any

 conduit permit tcp host 172.16.20.80 eq 3000 any

 conduit permit tcp host 172.16.20.80 eq 3000 host 72.16.20.80

 conduit permit tcp host 190.3.79.94 eq 3000 any

 no rip outside passive

 no rip outside default

 no rip inside passive

 no rip inside default

 no rip iis_verizon passive

 no rip iis_verizon default

 no rip conexion_verizon passive

 no rip conexion_verizon default

 no rip prueba passive

 no rip prueba default

 no rip broadband passive

 no rip broadband default

 route outside 0.0.0.0 0.0.0.0 190.3.79.89 1

 route broadband 0.0.0.0 0.0.0.0 200.88.113.145 2

 timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00

 timeout rpc 0:10:00 h323 0:05:00

 timeout uauth 0:05:00 absolute

 aaa-server TACACS+ protocol tacacs+

 aaa-server RADIUS protocol radius

 no snmp-server location

 no snmp-server contact

 snmp-server community public

 no snmp-server enable traps

 telnet 172.16.20.99 255.255.0.0

 telnet timeout 5

 terminal width 80

 Cryptochecksum:76027820b41350aba2aa7d18596f84f8
 : end

I added this command in the Cisco pix firewall:

conduit permit tcp host 172.16.20.99 any eq 8000

where 172.16.20.99 is my barracuda appliance IP, but it still doesn't work. it seems like the port remains closed, is there any command I can use to determine if a port is being allowed through the PIX firewall.  

Try Istvan's suggestion of the global commands.  I'll look at whether there's a summary command on 4.4.