What is the matching order of the firewall policy routes?

31

The matching order of the firewall policy routes is matched according to the node serial number following the policy-based-route policy from small to large.

Other related questions:
Security policy matching order on the USG6000
On the USG6000, the device preferentially executes security policies configured earlier. Therefore, you are advised to first configure security policies with smaller matching scopes and accurate matching conditions and then configure security policies with larger matching scopes and wider matching conditions.

Security policy matching order on the USG9000 series
When multiple security policies are to be matched, they are matched in a specific order. Therefore, you are advised to configure more fine-grained security policies first.

Security policy matching order on the USG6000 series
When multiple security policies are to be matched, they are matched in a specific order. Therefore, you are advised to configure more fine-grained security policies first.

What is the matching order of an ACL on a WLAN device
If ACL rules repeat or conflict, the matching order decides the packet matching result. WLAN devices support two ACL matching orders: the configuration order (config) and the automatic order (auto). Configuration order The system matches packets against ACL rules in ascending order of rule IDs. That is, the rule with the smallest ID is processed first. If a smaller rule ID is manually specified for a rule, the rule is inserted in one of the front lines of an ACL and processed earlier. If no ID is manually specified for a rule, the system allocates an ID to the rule. The rule ID is greater than the largest rule ID in the ACL and is the minimum multiple of the step; therefore, this rule is processed last. Automatic order The system arranges rules according to precision degree of the rules (depth priority), and matches packets against the rules in descending order of precision. A rule with the highest precision defines strictest conditions, and has the highest priority. The system matches packets against this rule first.

FAQ-ACL matching order
Question: How do rules in an ACL take effect?

Answer: An ACL consists of multiple deny | permit clauses, each of which describes a rule. The device supports two matching orders: the configuration order (config) and the automatic order (auto). The default order is config, that is, rules are processed in the order that they are configured. You can use the match-order { auto | config } command to change the matching order. auto: indicates that ACL rules are processed based on the depth first principle. If the ACL rules are of the same depth first order, they are processed in ascending order of rule IDs. For details about the depth first principle, see Configuration > CLI-based Configuration > Configuration Guide - Security > ACL Configuration > Principle > Matching Order in the product documentation. config: indicates that the rules are processed based on the configuration order. If rule IDs are specified, packets match ACL rules in ascending order of rule IDs.


If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top