topic Re: Policy Rules order in General Topics

Policy Rules order

Rboehme — Wed, 23 Nov 2016 13:49:18 GMT

Hi there,

if we are going to the tab "Policy" we will see 7 different sub tabs. The tabs are:

Security

NAT

QoS

PBF

App Override

Captive Portal

DoS Protection

So I know for example that Security rules are always checked before NAT rules but whats about the rest? I spent planty of time google for this information but without success.

Re: Policy Rules order

TranceforLife — Wed, 23 Nov 2016 14:05:21 GMT

Hi,

For the security and NAT it is will go in order. My guess for rest of the sub tabs as well.

So security policy from top > bottom until first match. If the NAT is configured same from top > bottom. Traffic will be scanned from top>bottom for every sub tabs if configured.

Re: Policy Rules order

FJU-ITCS — Wed, 23 Nov 2016 14:08:48 GMT

Maybe this would help: https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081

Re: Policy Rules order

pulukas — Thu, 24 Nov 2016 16:58:27 GMT

Do look at the packet flow process noted above. The general flow is:

Routing lookup - This is needed to assign zones and know the egress interface

NAT - This occurs then to get the final ip addresses after NAT

Security policy check - now we have all the information to confirm if the flow is permitted

Deeper inspections - if permitted, we perform any deep inspections applied to the policy

https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081