Can't this be in the policy?  network_port or portcon?