PAN-OS policy evaluation order
Put a Panorama rulebase into the order PAN-OS actually evaluates it, trace a flow to the deciding rule, and find the rules that never fire because something above them already matched.
Security & WAFRuns entirely in your browser. A rulebase names your zones, subnets and users, and none of it leaves this page.
API endpointGEThttps://ronutz.com/api/v1/panos-policy-evaluation-orderDocumented, not served. Opens the specification.
Références
- Palo Alto Networks, Device Groups: a firewall evaluates policy rules by layer and by type, top to bottom; local firewall rules display between the pre-rules and post-rules
- Palo Alto Networks, Security Policy Rulebase Best Practices: first match wins and comparison stops; 'Commit and Push doesn't provide shadowing information'
- Palo Alto Networks, Security Policy Rule Best Practices: shadowing defined; intrazone-default allows and interzone-default denies
- Palo Alto Networks, Defining Policies on Panorama: pre-rules are added to the top of the rule order and evaluated first; post-rules are evaluated last