port 256/257 and firewall-1

[George Wang <wangw () singnet com sg>]

Hi,

I have configured the firewall-1's policy to only pass DNS and WWW,
however when I do a port scan from external side, it reveals that ports
256/257 TCP also open. I think it's for firewall-1's control module. 

Could anyone tell me whether there is any risk for this and is it
necessary to explicitly add a filtering rule to reject pkts destined for
these ports from external side?

thanks for any advice.