A firewall policy set evaluates rules from top to bottom and stops at the first...

Rule 1 can match immediately on the user, protocol, and destination port, so its Allow action terminates evaluation before the anonymizer or subnet blocks are considered. Zscaler’s network-application guidance distinguishes application-aware rules from rules capable of a first-packet match, while its recommended Firewall Control Policy emphasizes granular higher-order controls above broad allowances. The result is predictable shadowing: Marketing receives unrestricted HTTPS access, including anonymizers, and gains an evasion path that can conceal malicious activity or data transfer. The global application rule does not automatically override an earlier match, and IPS does not replace the Firewall Filtering decision described. Rule 3 applies only when the destination belongs to the specified subnet; no such fact is given. The policy should place required global blocks before broad departmental allows or narrow the allow’s destination and application criteria.