The InstaSafe Secure Access (ISA) Solution makes use of a TLS Tunnel for the transmission of application data traffic. UDP Ports are more suitable for the TLS Tunnel primarily because it offers increased security against DDOS and other attacks. TCP ports are less secure since they are subjective to TCP flooding and similar attacks. 

Making use of a TCP port essentially means that the implementation would use TCP over TCP (where the carrier TLS connection and the application traffic are both based on a TCP connection). This can degrade the performance and lead to low throughput in case of a congested or a flaky internet connection.

Due to these reasons, the ISA Solution predominantly makes use of UDP ports. Any Custom UDP Port (outbound) could be used in order to establish connections from the data centers and the end-points to the ISA Controller.