NGFW Engine and Policy Configuration
Domain 2 examines Policy Editor behavior: rule order and actions, NAT, inspection policy binding, template use and policy installation. The exam expects you to predict which rule or NAT entry wins and whether inspection actually runs.
Rule evaluation
- Rules are evaluated top-down. A matching rule with Allow, Discard or Refuse normally ends evaluation; Continue and Jump deliberately pass control onward.
- Discard drops silently; Refuse returns a rejection response. Choose Refuse for visible client errors, Discard for stealth.
- Put specific rules above broad catch-alls. A top rule matching Any service and Any destination hides every later rule.
- Use sections and tags for readability, but they do not change evaluation order.
- End with an explicit cleanup rule or a deliberate default action; do not rely on an accidental implicit drop for business traffic.
NAT and inspection
- NAT rules live in the same policy and are matched in order. The first matching NAT rule applies; a broad hide-NAT rule above a specific static NAT shadows it.
- Static NAT maps one address to one address; hide NAT maps many internal hosts to one external address. Add No NAT exceptions for site-to-site VPN traffic when addresses must remain original.
- An inspection policy must be referenced by an access rule. Creating an IPS or anti-malware policy without binding it to the rule leaves traffic uninspected.
- Policy installation is versioned. Validate, upload and install to the correct engine or cluster; keep the previous version for rollback.
Worked example
Publish an internal web server 192.0.2.10 as 203.0.113.10 on TCP 443 with IPS. Create a static NAT rule translating the public destination to the private server, placed above any generic outbound hide NAT. Create an access rule from Any to the translated server object on TCP 443 with Allow and the web inspection policy attached. Install to the edge cluster. Reasoning: the NAT rule must be specific and early; the access rule must reference the inspection policy or IPS never runs; installation target must be the cluster so both nodes receive it.
Traps that cost marks
- A broad Any/Any allow above the real rules.
- Forgetting No NAT for VPN traffic and breaking the tunnel selectors.
- Confusing Discard with Refuse.
- Assuming an inspection policy applies globally without a rule reference.
- Installing a policy to the wrong engine or forgetting to install after changes.