Hi @TonyDeHart ,
The Policy Optimizer identifies traffic on non-standard ports. Notice the "warning" icon.
However, if there is a mix of standard and non-standard, it does not show. That is one of the reasons you create a L7 application-default cloned rule above your L4 rule and add the applications to it. Then, the non-standard applications will hit the L4 rule and you should have the warning symbol in the Policy Optimizer. You should clear the apps seen in the L4 rule after you add apps to the L7 rule. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/app-id/security-policy-rule-optimization/policy-optimizer-concepts/clear-application-usage-data
You could also use the Log Viewer for a rule (drop down next to name) and view traffic that matches the rule. You can select the application and destination port and change the port.dst to neq.
Thanks,
Tom
... View more