Policy rules organization

[Support_IT]

hello Everyone hope everything is doing well.

questions for the experts on palo

i have 260 rules on my palo alto environment and they are subdivided in zones and i would like to make things more organized on my rules  .

question is the rules more high used on the palo should be always first ? like more verbose rules or it doesn't matter where they are they will be no performance issue ?

thank you

Matheus

[OtakarKlier]

Hello,

Tricky question. If you are running code 9 or 9.1 then there is a counter for each policy so you can see which ones get hit more often. A few things to remember is that the PAN evaluates policies top to bottom left to right. So the order of the policies matter. What I do is put the stuff I know is a block, e.g. dynamic block lists, at the top so they dont sneak through. Then order the policies of highest use closer to the top without over riding a more specific policy. 

Basically take your time and think it out. Do one or a few at a time so as not to cause confusion.

Hope that helps.