The Palo Alto Networks firewall does not classify traffic
by port and protocol; instead it identifies the application based
on its unique properties and transaction characteristics using the
App-ID technology. Some applications, however, require the firewall
to dynamically open
pinholes to establish the connection,
determine the parameters for the session and negotiate the ports
that will be used for the transfer of data; these applications use the
application-layer payload to communicate the dynamic TCP or UDP
ports on which the application opens data connections. For such
applications, the firewall serves as an Application Level Gateway
(ALG), and it opens a pinhole for a limited time and for exclusively
transferring data or control traffic. The firewall also performs
a NAT rewrite of the payload when necessary.
The following table lists IPv4, NAT, IPv6, NPTv6 and NAT64 ALGs
and indicates with a check mark whether the ALG supports each protocol
(such as SIP).