Every time a UTM feature is enabled, a port is opened on one or more addresses or interfaces.   Sometimes, the port may be opened for more interfaces than the system administrator would wish.  Unfortunately, UTM does not provide a simple way to understand which ports are open on which addresses or interfaces.   This document is a compilation of how I believe UTM behaves.   I am hoping that Sophos partners or other knowledgeable people will confirm or correct the information presented here, so that a complete and correct master list can be available to everyone.

General

Some UTM services listen on one or more IP Addresses.  Examples are User Portal and Webserver Protection/WAF.  Some UTM services listen to traffic as it arrives at one or more interfaces, intercepting traffic for certain destination ports, such as Transparent Web.   If a particular service does not have a configuration option in WebAdmin, the administrator should assume that the service will be active everywhere – either all UTM Addresses for an address-dependent service, or all Interfaces for an interface-dependent service.

Many services also have an Allowed Networks list which filters incoming traffic based on source IP.   Any packet with a source address outside the Allowed Networks list will be ignored by that service, and traffic which is not processed by other services will be processed by the Firewall Rules.  In the absence of source address spoofing, an Allowed Networks list can have the effect of limiting incoming traffic to specific interfaces for purposes of that service.   Firewall Rules have an option for spoof protection for packets that hit that layer.

The recommended way to globally block unwanted traffic is to use a DNAT rule to direct traffic to a dead-end destination.   This KB article explains how to ensure that port 3400 is only available to known RED device IP Addresses.

https://community.sophos.com/kb/en-us/126989

Rule #2 in this how-to document is also helpful for configuring DNAT rules.

https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz

The Port Usage Matrices

This is my compendium of UTM services and the ports that they use.   Please reply with your feedback.  Some of the information comes from the WebAdmin interface, some from the WebAdmin help, some from web searches to identify the industry-standard behavior that UTM implements, and some from conversations with Sophos Support.   Perhaps someday, Sophos will provide a GUI tool to display and manipulate which ports are enabled on which entry points, so that the system administrator will not need to guess from a user-developed document like this one.    I hope other users find this helpful.

An Interface Group object can be used to group multiple Interface Addresses into one object, and can probably be used anywhere that an Interface Address is requested.  An Interface Group, or a Network Group of Interface and Additional Addresses, may be usable wherever a Target Address is requested.  Consequently, in the table below I use the term "One Interface Object" to represent an Interface Address or Interface Group.  Similarly, I use the term "One Address Object" to represent an Additional Address, Interface Address, Interface Group, or Network Group.

User Portal and SSL VPN documentation indicate that the default is "Any".   I have not used this setting, so I am unclear whether this should be configured by leaving the address blank or by configuring the "Any" object into the GUI; most likely, either will work.   I expect that "Any" will include both Additional Addresses and Interface Addresses.   The documentation notes that using Any may create port conflicts with WAF.  To avoid ambiguity, I suggest using an Interface Group or Network Group, instead of blank or Any, to choose a list of interfaces for those services.

Interface Groups are a way of representing multiple interfaces with one object.   In the list below, most services are not configurable to an interface.  For the ones that are configurable, I don't think an Interface Group would make sense, but their use may be possible.