Palo Alto Device Group Rule Processing
paloalto panorama reference
Processing Order
| Order | Rule Stage | Processing Hierarchy | Description |
|---|
| 1 | Pre-Rules | Top-Down | Evaluated from the highest-level (parent) device group down to the most specific (child) device group. |
| 2 | Local Firewall Rules | N/A | Rules configured directly on the firewall are processed after all Pre-Rules have been evaluated. |
| 3 | Post-Rules | Bottom-Up (Reverse) | Evaluated from the most specific (child) device group back up to the highest-level (parent) device group. |
| 4 | Default Rules | N/A | If no match is found, the default intrazone-default or interzone-default rule is applied. |
Processing Flow Diagram
flowchart TD
A["Start Traffic"]
SP["Shared Pre-Rules (top-down)"]
SP_M{"Match?"}
DGP["DG Pre-Rules (ancestor → child, each top-down)"]
DGP_M{"Match?"}
L["Local Firewall Rules (top-down)"]
L_M{"Match?"}
DGS["DG Post-Rules (child → ancestor, each top-down)"]
DGS_M{"Match?"}
SS["Shared Post-Rules (top-down)"]
SS_M{"Match?"}
DEF["Default Rules (e.g., interzone-default)"]
Z["Action Taken & Stop"]
A --> SP --> SP_M
SP_M -- Yes --> Z
SP_M -- No --> DGP
DGP --> DGP_M
DGP_M -- Yes --> Z
DGP_M -- No --> L
L --> L_M
L_M -- Yes --> Z
L_M -- No --> DGS
DGS --> DGS_M
DGS_M -- Yes --> Z
DGS_M -- No --> SS
SS --> SS_M
SS_M -- Yes --> Z
SS_M -- No --> DEF --> Z