Policy Management and Rule Base
Core concepts
A rule base is evaluated top-down, first match wins. Each rule has Source, Destination, Service/Application, Action, Track, and Install On. Understand implicit rules: the Cleanup rule (drop + log) at the bottom, the Implied rules (e.g., control connections, DHCP, Drop/Accept for implied traffic) that sit above the explicit rule base, and how they interact with logging.
Structure and hygiene
Know sections, inline layers, and how order matters. Understand negate on source/destination, and the risk it creates. Be clear on Track options (Log, Account, None) and how logging affects performance and troubleshooting. Know Global properties (e.g., accept/drop for implied rules) and policy installation targets.
Traps in questions
- A broad "Accept Any" rule placed above specific rules shadows them - first match wins.
- Implied rules can accept traffic you did not explicitly allow (e.g., management connections); questions test whether you know they exist.
- The Cleanup rule logs drops only if Track is set; otherwise drops are silent.
- Negated rules are hard to read and often the wrong answer when a specific allow is intended.
Rule of thumb
Place specific rules above general ones, end with an explicit Cleanup drop that logs, and read the rule base top-down when diagnosing unexpected behavior.