topic Re: Rule shadowing in General Topics

Rule shadowing

jdprovine — Thu, 02 Apr 2015 18:26:48 GMT

does that basically mean you have more than one rule doing the same thing?

Re: Rule shadowing

Bradley_Melton — Thu, 02 Apr 2015 19:20:53 GMT

Yes. It means that traffic will never hit the rule you just added because there is a rule above it that matches (at least) all of the criteria of the one you just created.

https://live.paloaltonetworks.com/docs/DOC-1624

Re: Rule shadowing

jdprovine — Thu, 02 Apr 2015 21:38:13 GMT

so the rule needs to be moved above the rule that it shadows to be affective if there are any differences in the rule to start with

Re: Rule shadowing

pulukas — Fri, 03 Apr 2015 10:37:18 GMT

jprovine wrote:

so the rule needs to be moved above the rule that it shadows to be affective if there are any differences in the rule to start with

Correct, firewall rules are processed from the top of the list down. And they stop processing on the FIRST match of criteria.

Thus you need your most specific rules to appear in the rule base before the least specific rules.