Policy, using App ID ssl, is bypassed in favor of service based policy

[Inelse]

Hi All,

I'm new to Palo so hope you guys can help me understand something.

We have two almost identical security policies that allow traffic via ports tcp/443 and 80. The first policy uses App IDs, ssl and web-browsing. The second policy uses services tcp/443, 80. My expectation is that the second policy should never be hit since ports 443 and 80 are allowed by the first policy, but this is not the case. Both policies receive a lot of hits on port 443.

My question is, why is the first policy bypassed for tcp/443 traffic?

Thanks!

[Inelse]

Thanks Nikolay.

It looks like we would have to leave the two rules active as they are. I've checked the applications that are detected by the service port rule and there are just too many. This rule is for general user web traffic so can't be too restrictive.