What is the correct sequence of evaluation for Security policy rulebases?

Palo Alto Networks Panorama evaluates security policy rulebases in a specific top-down order: Pre-Rules from Panorama are checked first, then local firewall rules, then Panorama Post-Rules.

Configure and Manage Security Policies

Question

Options

APanorama Pre-Rules --> Local Firewall Rules --> Panorama Post-Rules
BPanorama Post-Rules --> Panorama Pre-Rules --> Local Firewall Rules
CPanorama Shared Rules --> Local Firewall Rules --> Device Group Rules
DLocal Firewall Rules --> Panorama Pre-Rules --> Panorama Post-Rules

Why each option

Palo Alto Networks Panorama evaluates security policy rulebases in a specific top-down order: Pre-Rules from Panorama are checked first, then local firewall rules, then Panorama Post-Rules.

APanorama Pre-Rules --> Local Firewall Rules --> Panorama Post-Rules

BPanorama Post-Rules --> Panorama Pre-Rules --> Local Firewall Rules

This reverses the correct order - Post-Rules are always evaluated after Pre-Rules and local rules, not before them, by design.

CPanorama Shared Rules --> Local Firewall Rules --> Device Group Rules

Panorama does not use a 'Shared Rules' tier followed by 'Device Group Rules' as a rulebase evaluation sequence - this misrepresents how Panorama policy inheritance and evaluation work.

DLocal Firewall Rules --> Panorama Pre-Rules --> Panorama Post-Rules

Local firewall rules are never evaluated before Panorama Pre-Rules - Pre-Rules are intentionally placed first to allow centralized administrators to enforce policies that cannot be overridden by local rules.

Concept tested: Panorama security policy rulebase evaluation order

Source: https://docs.paloaltonetworks.com/panorama/11-1/panorama-admin/manage-firewalls/manage-security-policies/security-policy-rule-evaluation-order

Topics

#Security Policy#Rulebase Evaluation Order#Panorama#Policy Hierarchy

Community Discussion

No community discussion yet for this question.

Full NGFW-ENGINEER Practice