When you define Security policies for specific applications, you can select one or more services to limit the port numbers the applications can use. The default service is any, which allows all TCP and UDP ports. The HTTP and HTTPS services are predefined, but you can add additional service definitions. Services that are often assigned together can be combined into service groups to simplify the creation of Security policies (refer to Objects > Service Groups).

Additionally, you can use service objects to specify service-based session timeouts—this means that you can apply different timeouts to different user groups even when those groups are using the same TCP or UDP service, or, if you’re migrating from a port-based Security policy with custom applications to an application-based Security policy, you can easily maintain your custom application timeouts.

The following table describes the service settings: