Policy Rules order

[Rboehme]

Hi there,

if we are going to the tab "Policy" we will see 7 different sub tabs. The tabs are:

Security

NAT

QoS

PBF

App Override

Captive Portal

DoS Protection

So I know for example that Security rules are always checked before NAT rules but whats about the rest? I spent planty of time google for this information but without success.

[TranceforLife]

Hi,

For the security and NAT it is will go in order. My guess for rest of the sub tabs as well. 

So security policy from top > bottom until first match. If the NAT is configured same from top > bottom. Traffic will be scanned from top>bottom for every sub tabs if configured.

[FJU-ITCS]

Maybe this would help: https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081

[pulukas]

Do look at the packet flow process noted above. The general flow is:

Routing lookup -  This is needed to assign zones and know the egress interface

NAT - This occurs then to get the final ip addresses after NAT

Security policy check - now we have all the information to confirm if the flow is permitted

Deeper inspections - if permitted, we perform any deep inspections applied to the policy

https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081