{"id":223,"date":"2009-04-03T09:23:55","date_gmt":"2009-04-03T09:23:55","guid":{"rendered":"https:\/\/fir3netwp.gmsrrpobkbd.com\/2009\/04\/03\/netscreen-rule-processing-order\/"},"modified":"2021-07-24T19:10:15","modified_gmt":"2021-07-24T19:10:15","slug":"netscreen-rule-processing-order","status":"publish","type":"post","link":"https:\/\/www.fir3net.com\/Firewalls\/Juniper\/netscreen-rule-processing-order.html","title":{"rendered":"Netscreen – Rule Processing Order"},"content":{"rendered":"

Rule Processing Order<\/strong><\/p>\n

The general processing order is as follows,<\/p>\n

    \n
  1. Look for a policy between the ingress and egress zones<\/li>\n
  2. If no policy is found (in step 1), search for a Global policy<\/li>\n
  3. If no Global policy is found and if the ingress zone is same as the egress zone, apply the intra-zone block i.e if intra-zone block is enabled, drop the packet unless an intra-zone rule permits.<\/li>\n
  4. Implied deny all (also known as the Default Policy) <\/li>\n<\/ol>\n

    So to summarize the above,<\/p>\n

      \n
    1. Policy for Ingress > Egress Zone<\/li>\n
    2. Global Policy<\/li>\n
    3. Intra-Zone Policy<\/li>\n
    4. Implied deny all<\/li>\n<\/ol>\n

      Logging<\/strong><\/p>\n

      Taking the above into account. The following will apply,<\/p>\n