Server's acl:
access-list 915out-cftfw1 extended permit ip host 128.103.64.145 host 128.103.170.28
access-list 915out-cftfw1 extended permit ip host 128.103.64.147 host 128.103.170.28

Client's acl:
access-list 996out-oxfw2 extended permit tcp host 128.103.170.28 host 128.103.64.145 range 10000 40000
access-list 996out-oxfw2 extended permit tcp host 128.103.170.28 host 128.103.64.145 eq sunrpc
access-list 996out-oxfw2 extended permit tcp host 128.103.170.28 host 128.103.64.145 eq 2049
access-list 996out-oxfw2 extended permit tcp host 128.103.170.28 host 128.103.64.145 eq 4045
access-list 996out-oxfw2 extended permit udp host 128.103.170.28 host 128.103.64.145 range 10000 40000
access-list 996out-oxfw2 extended permit udp host 128.103.170.28 host 128.103.64.145 eq sunrpc
access-list 996out-oxfw2 extended permit udp host 128.103.170.28 host 128.103.64.145 eq 2049
access-list 996out-oxfw2 extended permit udp host 128.103.170.28 host 128.103.64.145 eq 4045

client's ipfilter (on VM host)
rpcinfo: can't contact portmapper: RPC: Timed out
# cat /etc/ipf/ipf.conf
#
# ipf.conf
#
# IP Filter rules to be loaded during startup
#
# See ipf(4) manpage for more information on
# IP Filter rules syntax.

# Open up loopback
pass out quick on lo0 all
pass in quick on lo0 all

# Allow ICMP
pass in quick proto icmp all keep state
pass out quick proto icmp all keep state

# Outbound is open, keep state to allow return packets back in
pass out quick proto tcp/udp all keep state

# Block incoming NetBIOS, before we start logging blocks
block in quick from any to any port = 135
block in quick from any to any port 136><140

# Default block on all inbound
block in log all

# Allow inbound SSH
pass in quick proto tcp from 128.103.170.0/24 to any port = 22
pass in quick proto tcp from 10.1.67.0/24 to any port = 22
pass in quick proto tcp from 10.1.64.139 to any port = 22
pass in quick proto tcp from 128.103.64.0/24 to any port = 22

# Allow Web Service to sandbox
pass in quick proto tcp from any to 128.103.64.143 port =  80
pass in quick proto tcp from any to 128.103.64.143 port = 443

# Allow Web Service to dev:
pass in quick proto tcp from any to 128.103.64.145 port =  80
pass in quick proto tcp from any to 128.103.64.145 port = 443

# Allow Web Service to stage:
pass in quick proto tcp from any to 128.103.64.147 port =  80
pass in quick proto tcp from any to 128.103.64.147 port = 443

# Legato connections from legato2 and willie
pass in quick proto tcp from 128.103.56.20 to any
pass in quick proto tcp from 128.103.56.21 to any

# open up to terra and www (will close www when build is complete)
pass in quick proto tcp/udp from 128.103.170.28 to any
pass in quick proto tcp/udp from 128.103.170.46 to any

#open up to new-www
pass in quick proto tcp/udp from 128.103.64.144 to any