Rule preemption
Rule preemption is a policy evaluation condition that occurs when a rule will never match traffic because a rule earlier in the evaluation order matches the traffic first. A rule's conditions govern whether it preempts other rules.
Rule preemption scenarios
Any type of rule condition can preempt a subsequent rule. This table shows common preemption scenarios:
|
Rule 1 (preempting) |
Rule 2 (preempted) |
Rule preemption scenario |
|---|---|---|
|
Allow Admin users |
Block Admin users |
The second rule cannot block Admin traffic because the first rule allows it. |
|
Allow Source Network VLAN 22-33 |
Block Source Network VLAN 27 |
The VLAN range in the first rule includes the VLAN in the second rule, so the first rule preempts the second. To block VLAN 27, you must move that rule above the one that allows VLAN 22-33. |
|
Allow Source Network 10.4.0.0/16 |
Allow Source Network 10.4.0.0/16, VLAN 2 |
The VLAN range in the first rule includes the VLAN in the second rule, so the first rule preempts the second. To block VLAN 27, you must move that rule above the one that allows VLAN 22-33. |
|
Allow Source Network 10.10.10.0/24 to URL www.netflix.com |
Allow Source Network 10.10.10.0/24 to URL www.netflix.com |
A rule also preempts an identical subsequent rule where all configured conditions are the same. |