Question about policies and policy order

[hervaltelecom]

Hello!

I have a question about policies and policy orders. We have CFTV in all of our stores. What i have configured is a policy accepting access during work time but with traffic shape and another policy to accepting access any time and without restrictions because most access are controlled in the outbound policies, not inbound. You can see in the picture attached, policy 100 has the shape (does not show thou), and policy 103 does not have any restrictions. My question is, will the policy 100 that is restricting connection speed be enforced when there is another policy albeit below permiting full speed access? Same case with 101 and 102.

Thanks.

[Dave_Hall]

Can't really tell from the screenshot without the column headers, but assuming traffic hitting policy#100 matches source all, dest "GRP-DVR-TAQI", and time(?) "SCH-COMERICAL-TAQI" then that firewall rule will only be executed without the further rules (below) it being processed.  

Firewall rules are execute from top to bottom until a matched rule is found, the rules below the "found" match are not processed.  I think the only time a rule falls through is when you have an identity authentication rule - someone correct me on this if it is not correct.

[sw2090]

Yes since this is an inbound policy it is like Dave wrote:

the first policy that matches the packet wins the packet. And Policies are always exempt on a FGT.

In your case if policy 100 matches then this traffic is handled accoarding to policy 100.

Policy 103 will then never apply.

[emnoc]

The only way to make 103 become enforced if you had a time of day or schedule set for policy #100.

Ken 

[sw2090]

indeed beause then #100 will not match outside schedule.