It doesn't matter what you think you know... Most firewalls do block everything but the common ports. 80, 23, etc. Not leaving either of the ports you mention open, with no problems at all.

I agree with you that certification doesn't mean much, but I do know what I'm talking about as I set up firewalls, routers, and so forth. Always only leaving open the public ports, and a few private ones for AIM and the like.

My current firewall settings... Notice no open 2000 or 4000.

Starting nmap V. 2.53 by fyodor@insecure.org ( www.insecure.org/nmap/ )
Interesting ports on (10.150.10.64):
(The 1499 ports scanned but not shown below are in state: filtered)
Port State Service
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
43/tcp open whois
53/tcp open domain
70/tcp open gopher
80/tcp open http
109/tcp open pop-2
110/tcp open pop-3
119/tcp open nntp
441/tcp open decvms-sysmgt
442/tcp open cvc_hostd
443/tcp open https
554/tcp open rtsp
648/tcp open unknown
820/tcp open unknown
821/tcp open unknown
822/tcp open unknown
823/tcp open unknown
1080/tcp open socks
1433/tcp open ms-sql-s
5190/tcp open aol
8080/tcp open http-proxy