The answer depends on how the FTD classifies the App DNS based on what it finds in the header of the packet. Normally this will match correctly and in this case the first rule will be used. In the cases where the FTD does not recognize or match on the header for App DNS, then there will be no match on the first rule but as long as the destination port is either tcp/udp 53 then second rule will be matched.
So in summary, whether or not the first rule is matched depends on what the FTD is looking for in the header and if that is matched in the App DNS packet. I have seen rules work for a long time and then there is a new update which causes the FTD to not categorize the packet correctly and it stops matching.
When documents/resources refers to Lina l3/l4 being matched first, are they referring to the prefilter policy?
Yes and no. you can match on L3 and L4 in ACP, but if you are matching on them in ACP they will almost always be sent to SNORT anyway for security intelligence inspection and in some cases for regular SNORT / deep packet inspection. When prefilter is configured, that traffic in the prefilter rules will never be sent to SNORT. So, the answer depends on the context of the document when referring to L3 and L4 match.
--
Please remember to select a correct answer and rate helpful posts
