# ZIA firewall rule-order simulator

> Paste a Firewall Filtering rule list and an optional flow: watch ascending-order, first-match evaluation execute, see which rule (or the deny-by-default Default rule) decides, and get pairwise shadow findings naming the rules that can never fire.

- Tool: https://ronutz.com/en/tools/zscaler-firewall-rule-order-simulator
- Family: Security & WAF

---

## What this tool does

Paste a Zscaler Internet Access (ZIA) Firewall Filtering rule list in a small teaching grammar - one rule per line as `order | name | action | criteria` - plus an optional `flow:` line, and the simulator executes the documented policy semantics in front of you: rules sorted into ascending numerical order, the flow traced rule by rule with evaluation stopping at the first match, the verdict named (a rule, or the Default Firewall Filtering Rule for whatever fell through), and a pairwise shadow analysis listing rules that can never fire because an earlier rule already covers everything they could match.

## The grammar

Rules: `10 | allow-web | allow | proto=tcp port=443 dest=203.0.113.0/24 src=any`, with actions `allow`, `block` (silent drop), or `block-icmp` (block informing the client), and an optional `disabled` token. Criteria left out mean Any - and Any is ignored during evaluation, exactly as the vendor documents. Optional lines: `flow: proto=tcp port=8443 dest=203.0.113.7 src=10.0.0.5` to trace, and `default: allow|block` to model a super-admin edit of the Default rule's action. Lines starting with `#` are comments.

## What the semantics encode

Everything simulated is Zscaler's published behavior: evaluation ascends the Rule Order and stops at the first match; a disabled rule is not enforced but keeps its place (the service skips it and moves on); the Default Firewall Filtering Rule is undeletable, always lowest precedence, its criteria fixed and only its action editable - and out of the box it blocks all traffic, which is why the simulator's default, absent a `default:` line, is block.

## Honest limits

The criteria model here is a deliberate teaching subset - protocol, ports, source, destination. Real Firewall Filtering rules add users, groups, departments, locations, network services and applications, destination countries, device trust levels, and time windows; the ordering semantics this tool teaches apply to all of them identically. The shadow analysis is pairwise only: a rule covered by several earlier rules jointly, but by none alone, is not flagged. Predefined system rules (Office 365, Zscaler service traffic) and Admin Rank order bounds are described in the paired article but not simulated.

## Sources

Grounded in three Zscaler Help pages, each pinned with its access date in the tool manifest: About Firewall Filtering (evaluation order, the deny-by-default Default rule, the action verb set), Configuring the Firewall Filtering Policy (Rule Order, the Any-means-ignored convention, Admin Rank), and Editing the Default Firewall Filtering Rule (lowest precedence, undeletable, fixed criteria, super-admin action edit).

## Standards and references

- [Zscaler Help: About Firewall Filtering](https://help.zscaler.com/zia/about-firewall-filtering) - ascending-order evaluation; the Default Firewall Filtering Rule blocking all traffic when the firewall is enabled (deny-by-default); the action verb set (allow, silent block, block informing the client); the criteria dimensions
- [Zscaler Help: Configuring the Firewall Filtering Policy](https://help.zscaler.com/zia/configuring-firewall-filtering-policy) - Rule Order as the ascending evaluation position; unset criteria meaning Any and being ignored during evaluation; Admin Rank bounding assignable orders; the criteria field inventory (network services, source/destination addresses, device trust, time windows)
- [Zscaler Help: Editing the Default Firewall Filtering Rule](https://help.zscaler.com/zia/editing-default-firewall-filtering-rule) - the default rule handling all traffic not matching a higher-order rule; always lowest precedence; undeletable; fixed criteria; action editable by super admins only

## Related reading

- [ZIA Cloud Firewall: Rule Order Is the Whole Ballgame](https://ronutz.com/en/learn/zia-cloud-firewall-rule-order.md): The Firewall Filtering policy is a first-match machine: rules evaluated in ascending order, evaluation stops at the first hit, and the undeletable default rule at the bottom blocks everything that fell through. The rule anatomy, the any-means-ignored criteria convention, disabled rules that keep their seat, the recommended-policy pattern, and the shadowing failure that order makes possible.