Where a firewall blocks all traffic on a given range of port numbers, the IDS/IPSs (written as 'IDP/IPSs' in the source) should inspect traffic for those ports and raise an alert if any is seen.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.