I don't know Norton but I noticed into Outpost that it "watchs" a portscan with only 2 quick attempts to connect, maybe Norton has to view more than this to "watch" a portscan (ie. it is less sensible than Outpost)

Only a possibility, I repeat I don't know Norton and I'm not a firewall expert.