Port variables

A port variable is a network configuration element that

  • represents TCP and UDP ports you can use in the Source Port and Destination Port header fields in intrusion rules,

  • is specific to intrusion rules and differs from port objects and port object groups, and

  • can be used to restrict packet inspection to packets originating from or destined to specific TCP or UDP ports.

Port variable configuration details

Port variables are linked to intrusion policies associated with access control rules or policies, determining the values for these variables in the network traffic where you deploy the access control policy.

When configuring a port variable, you can include:

  • any combination of port variables and port objects that you select from the list of available ports (excluding port object groups, which cannot be added to variables),

  • individual port objects that you add while creating or editing a variable, which can also be reused for other variables,

  • and single literal port values as well as port ranges (ranges must use a dash, e.g., 80-90; colon-separated ranges are supported for backward compatibility but not for new variables).

    You can list multiple literal port values and ranges by adding each individually in any combination.

Port variable configuration has these important considerations:

  • The default value for included ports in any variable is any, indicating all ports or port ranges. The default for excluded ports is none, indicating no ports.

    Tip

    To create a variable with the value any, name and save the variable without adding a specific value.

  • You cannot exclude the value any from a variable, as that would result in no ports being matched.

  • Adding ports to an excluded list prevents matching on those specified ports or port ranges. The system matches any port except those excluded.

  • Excluded values must be a subset of the included values. For example, if you include the port range 10-50, you cannot exclude port 60.