What do you configure if you want to set up a group of objects based on their ports alone?

In the Palo Alto Networks PAN-OS, a "Service" object explicitly defines a protocol (like TCP or UDP) and its associated port number or a range of ports. To create a logical collection of these port-based definitions, you configure a "Service Group." This allows you to bundle multiple Service objects together, such as services for HTTP (TCP/80), HTTPS (TCP/443), and DNS (UDP/53), into a single, reusable object. This Service Group can then be applied to Security policy rules to simplify administration and improve readability, as you reference one group instead of many individual services.

A. Application groups: These are collections of application signatures (e.g., web-browsing, ssl), which are identified by more than just port numbers.

C. Address groups: These are collections of IP address objects, such as hosts, subnets, or IP ranges, not port definitions.

D. Custom objects: This is a generic term. The specific and correct object type for grouping port-based services is a Service Group.

1. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator's Guide. Objects > Services. The guide states

"A service is a combination of a transport protocol (such as TCP or UDP) and one or more port numbers." This establishes the base object.

2. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator's Guide. Objects > Service Groups. The documentation defines this object type: "A service group is a collection of services that you can use in policies instead of entering each service individually." This directly answers the question about grouping.

3. Palo Alto Networks. (2021). PAN-OS® 10.1 Administrator's Guide. Objects > Address Groups. This section clarifies that Address Groups are used to "group multiple IP addresses so that you can apply policy to all of them at once

" distinguishing them from port-based objects.

4. Palo Alto Networks. (2021). PAN-OS® 10.1 Administrator's Guide. Objects > Application Groups. This section defines Application Groups as a way to "group applications so that you can use the group in policy rules

" differentiating them from Service Groups.