We have a Pix 515e with an Access-Control-List set only on the outside interface. We want a Win2k3 server PDC to obtain time via an Internet time server and have set the Win2k3 server to do so. NTP packets are either not getting out through the Pix or not getting back in through the Pix. Debug on the inside interface shows NTP packets arriving when the Win2k3 Server attempts to synchronize time with an Internet Time Server; but Debug on the outside interface doesn't show time coming back. Anyway, since there's only an ACL on the outside interface, we're expecting all inbound-to-outbound-initiated "2-way conversations" to be allowed??? How should the Pix be setup so this will work?