Ports

A port object is a network configuration element that

represents different protocols, such as TCP, UDP, ICMP, and others, in distinct ways
can specify protocol numbers, port numbers or ranges, and optional type and code for certain protocols, and
is used to define access and monitoring rules within the system’s web interface.

Port object representations and usage

Port objects represent protocols differently depending on their type.

TCP and UDP: Port objects represent these transport layer protocols by specifying the protocol number, and may include an associated port or port range. For example: TCP(6)/22.
ICMP and ICMPv6 (IPv6-ICMP): Port objects represent these Internet layer protocols by specifying the protocol number and optional type and code. For example: ICMP(1):3:3.

Restrict an ICMP or IPV6-ICMP port object by type and, if needed, code. Learn more about ICMP types and codes at:
- ICMP Types and Codes: http://www.iana.org/assignments/ICMP-parameters/ICMP-parameters.xml
- ICMPv6 Types and Codes: http://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xml
Other protocols: Port objects can represent protocols that do not use ports.

The system provides default port objects for well-known ports. Default objects are read-only and always available for use. You can create custom port objects or groups in addition to the default ones.

Port objects and groups can be used throughout the system’s web interface in access control policies, identity rules, network discovery rules, port variables, and event searches. For example, you can configure a network discovery policy to exclude monitoring ports used by a custom client if it generates excessive or misleading events.

Guidelines for using port objects

You cannot add any protocol other than TCP or UDP for source port conditions in access control rules.
Set source and destination port conditions in a rule using only one transport protocol.
Add only supported protocols to a port object group used in a source port condition so that the rule takes effect on the managed device when you deploy the configuration.
To add a destination port, create a port object using only TCP or only UDP ports for the source port condition in a rule. Similarly, to add a source port, create a port object using only TCP or only UDP ports as the destination port condition.