SDWAN Security policy processing order

[csdinesh18]

When a packet macthes the URL-Filtering policy and Enterprise firewall policy, which one will take preference in Cisco SDWAN?

Could you help with order of packet processing for security policies in Cisco SDWAN?

[Kanan Huseynli]

Hi,

URL policy and Firewall policy are basically permit/deny policies, they don't determine exit interface and/ or next-hop device. So, if they both allow then traffic will be forwarded, if one of them denies then traffic will be denied.

The main point is when you do AAR (application aware routing) and data policy. In this case, the action should be taken that data policy will not override AAR policy.

See page 84 of below session:

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/TECCRS-2014.pdf

Regards,

[Naseer Anjan]

Hi,

Enterprise firewall policy will be checked first since it will acting on lower layer like L3 and L4 but URL filtering works on Layer7.