BIG-IP AFM - Advanced Firewall Manager's Network Firewall is a hierarchy, and the manual states its order plainly: policies process from the global context, to the route domain, and then to the virtual server or self IP, with management port rules processed separately and unable to take a policy at all. The sentence that decides real outcomes sits right next to that order: when traffic matches a rule within a context, that action is applied and the traffic is processed again at the next context. Accept, in other words, is a ticket to the next checkpoint, not through the whole building. Only accept-decisively ends the walk with a yes, the DevCentral overview's own wording: the packet is permitted and no further context processing is performed. Drop is silent; reject answers with a TCP RST or an ICMP unreachable.
Paste context declarations, the policies they enforce, and a packet line, and the walk runs in that documented order regardless of paste order. Each context renders as a step: the first matching rule, its action, and what the action means right there. Staged policies behave as the manual says staging behaves, the match is reported and connectivity is unaffected. Rule-lists expand in place, matching the recommendation to build policies from them.
Two sourced behaviors are enforced mechanically rather than mentioned in passing. The ICMP restriction, verbatim from the manual: rules for ICMP or ICMPv6 cannot be created on a self IP or virtual server context, and if a rule list smuggles one in, such a rule will be ignored; the walk skips those rules at edge contexts and says so. And the tool never invents a default: if no context terminates the packet and no default-action was declared, the walk says the disposition falls to the box's Default Firewall Action rather than guessing which mode you run.
A lone policy gets the audit using the system's own definitions: a rule whose criteria are fully covered by an earlier rule with the same action is redundant, with a different action conflicting, and the manual's special case is honored, accept versus accept-decisively count as conflicting even though both accept. Geolocation, FQDNs, and schedules are recognized and reported, not evaluated: a rule using them stops the walk with an honest indeterminate rather than a guess.
Everything runs locally; nothing you paste leaves the page, and nothing here touches any device.