Skip to content
ConfigProof

All controls

PAN-SEC-019MediumPAN-OS

Earlier rule covers this rule with different behavior

At a glance

Base severity

Medium

Area

Security Policies

Platform

PAN-OS

Evidence level

Derived0.95

Benchmark reference

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

In the analyzed configuration order, matching traffic is handled by the earlier rule. The later rule's different action, inspection or logging settings therefore do not govern that match set. This is a configuration conclusion, not proof about live traffic or that removing the later rule is safe.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

  1. Compare the two rules' match dimensions, actions, inspection profiles and logging settings with the intended policy.
  2. Review whether order or scope needs changing; do not remove a rule solely because it appears covered.
  3. Validate the proposed result with policy match tests and an approved change/rollback plan before committing.

Command line

PAN-OS CLI, standalone firewall, vsys1

move vsys vsys1 rulebase security rules <object-name> before <anchor-rule-name>

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.

Read it back

show vsys vsys1 rulebase security rules
Values to fill in2
<object-name>
The object's name, as it appears on your firewall
<anchor-rule-name>
The rule to place this one before
Before you type it1
  • Rule order decides who reaches what. Choose the anchor deliberately.

How to confirm the fix

  • Run a policy match query for a flow the later rule was meant to handle and confirm which rule answers.
  • Confirm the intended inspection and logging settings on the matching rule, then repeat the query after any approved change.

Limits

  • Rules with negated source or destination are skipped because containment cannot be proven. Dynamic address groups are treated as unresolvable.

Compliance references

No benchmark recommendation is mapped to this control in this version.

More in Security Policies

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis