Technical Tip: Internet Service (ISDB) port-range not being changed

ISDB Object IDs:

• Amazon-AWS (393320).
• Amazon-AWS.CloudFront (393481).

1. If the user wants to change the service ports for 'Amazon-AWS.CloudFront' from the default (1-65535) to 80 and 443.

config firewall internet-service-addition

    edit 393481

        set comment 'Amazon-AWS.CloudFront'
            config entry

                edit 1

                    set protocol 6
                        config port-range

                            edit 1

                                set start-port 443
                                set end-port 443

                            next
                            edit 2

                                set start-port 80
                                set end-port 80

                            next

end

2. Start the command to apply changes to 'Internet services' :

execute internet-service4 refresh
Internet Service IPv4 refresh start ...
Start to initialize APP file.
Start to initialize MAP file.
Internet Service is refreshed.

execute internet-service6 refresh
Internet Service IPv6 refresh start ...
Start to initialize APP file.
Start to initialize MAP file.
Internet Service is refreshed.

3. When checking information for Internet Service ID: 393481, the port does not change.

diagnose internet-service id 393481

...
216.137.62.0-216.137.62.255 country(840) region(2039) city(1106) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(6) port(1-65535)
216.137.62.0-216.137.62.255 country(840) region(2039) city(1106) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(17) port(1-65535)
216.137.63.0-216.137.63.255 country(840) region(596) city(1207) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(6) port(1-65535)
216.137.63.0-216.137.63.255 country(840) region(596) city(1207) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(17) port(1-65535)

Note:

If the ISDB object is a child of another ISDB object, then the 'internet-service-addition' configuration block for the child ISDB object does not apply.
Hence, the parent object 'Amazon-AWS' of 'Amazon-AWS.CloudFront' also needs to have its settings changed.

config firewall internet-service-addition

    edit 393481

        set comment 'Amazon-AWS.CloudFront'
            config entry

                edit 1

                    set protocol 6
                        config port-range

                            edit 1

                                set start-port 443
                                set end-port 443

                            next
                            edit 2

                                set start-port 80
                                set end-port 80

                            next

                            edit 393320

                                set comment 'Amazon-AWS'
                                    config entry

                                        edit 1

                                            set protocol 6
                                                config port-range

                                                    edit 1

                                                        set start-port 443
                                                        set end-port 443

                                                    next
                                                    edit 2

                                                        set start-port 80
                                                        set end-port 80

diagnose internet-service id 393481
...
216.137.62.0-216.137.62.255 country(840) region(2039) city(1106) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(6) port(443 80)
216.137.62.0-216.137.62.255 country(840) region(2039) city(1106) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(17) port(1-65535)
216.137.63.0-216.137.63.255 country(840) region(596) city(1207) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(6) port(443 80)
216.137.63.0-216.137.63.255 country(840) region(596) city(1207) blocklist(0x0) reputation(4), popularity(5) domain(1151) botnet(4096) proto(17) port(1-65535)

Note 2:
A complete protocol (whole TCP, UDP, or ICMP) entry can not be removed from the default database. For example, above ISDB object Amazon-AWS (393320) has TCP, UDP, and ICMP lists, and by default UDP lists ports 1-65535 without the above modifications. If there is a need to restrict the UDP ports, a separate entry needs to be created for protocol 17 using the above steps. If there is no need for UDP, start-port and end-port need to be 0-0 under the config port-range entry.
Refer to this article for UDP port entries: Technical Tip: How to configure custom port and port ranges into the ISDB entries.