Skip to content

Commit 9f76f13

Browse files
authored
Update rule-processing.md
Clarification and priority fix to rule processing example.
1 parent cd2b171 commit 9f76f13

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

articles/firewall/rule-processing.md

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -45,35 +45,35 @@ Here's an example policy:
4545
Assuming BaseRCG1 is a rule collection group priority (200) that contains the rule collections: DNATRC1, DNATRC3,NetworkRC1.\
4646
BaseRCG2 is a rule collection group priority (300) that contains the rule collections: AppRC2, NetworkRC2.\
4747
ChildRCG1 is a rule collection group priority (300) that contains the rule collections: ChNetRC1, ChAppRC1.\
48-
ChildRCG2 is a rule collection group that contains the rule collections: ChNetRC2, ChAppRC2,ChDNATRC3.
48+
ChildRCG2 is a rule collection group priority (650) that contains the rule collections: ChNetRC2, ChAppRC2,ChDNATRC3.
4949

5050
As per following table:
5151

5252
|Name |Type |Priority |Rules |Inherited from
5353
|---------|---------|---------|---------|-------|
5454
|BaseRCG1 |Rule collection group |200 |8 |Parent policy|
55-
|DNATRC1 |DNAT rule collection | 600 | 7 |Parent policy|
56-
|DNATRC3|DNAT rule collection|610|3|Parent policy|
57-
|NetworkRC1 |Network rule collection | 800 | 1 |Parent policy|
55+
| DNATRC1 |DNAT rule collection | 600 | 7 |Parent policy|
56+
| DNATRC3|DNAT rule collection|610|3|Parent policy|
57+
| NetworkRC1 |Network rule collection | 800 | 1 |Parent policy|
5858
|BaseRCG2 |Rule collection group |300 | 3 |Parent policy|
59-
|AppRC2 |Application rule collection | 1200 |2 |Parent policy
60-
|NetworkRC2 |Network rule collection |1300 | 1 |Parent policy|
59+
| AppRC2 |Application rule collection | 1200 |2 |Parent policy
60+
| NetworkRC2 |Network rule collection |1300 | 1 |Parent policy|
6161
|ChildRCG1 | Rule collection group | 300 |5 |-|
62-
|ChNetRC1 |Network rule collection | 700 | 3 |-|
63-
|ChAppRC1 | Application rule collection | 900 | 2 |-|
62+
| ChNetRC1 |Network rule collection | 700 | 3 |-|
63+
| ChAppRC1 | Application rule collection | 900 | 2 |-|
6464
|ChildRCG2 |Rule collection group | 650 | 9 |-|
65-
|ChNetRC2 |Network rule collection | 1100 | 2 |-|
66-
|ChAppRC2 | Application rule collection |2000 |7 |-|
67-
|ChDNATRC3 | DNAT rule collection | 3000 | 2 |-|
65+
| ChNetRC2 |Network rule collection | 1100 | 2 |-|
66+
| ChAppRC2 | Application rule collection |2000 |7 |-|
67+
| ChDNATRC3 | DNAT rule collection | 3000 | 2 |-|
6868

69-
Initial Processing:
69+
Initial Iteration for DNAT Rules:
7070

7171
The process begins by examining the rule collection group (RCG) with the lowest number, which is BaseRCG1 with a priority of 200. Within this group, it searches for DNAT rule collections and evaluates them according to their priorities. In this case, DNATRC1 (priority 600) and DNATRC3 (priority 610) are found and processed accordingly.\
72-
Next, it moves to the next RCG, BaseRCG2 (priority 200), but finds no DNAT rule collection.\
72+
Next, it moves to the next RCG, BaseRCG2 (priority 300), but finds no DNAT rule collection.\
7373
Following that, it proceeds to ChildRCG1 (priority 300), also without a DNAT rule collection.\
7474
Finally, it checks ChildRCG2 (priority 650) and finds the ChDNATRC3 rule collection (priority 3000).
7575

76-
Iteration Within Rule Collection Groups:
76+
Iteration for NETWORK Rules:
7777

7878
Returning to BaseRCG1, the iteration continues, this time for NETWORK rules. Only NetworkRC1 (priority 800) is found.\
7979
Then, it moves to BaseRCG2, where NetworkRC2 (priority 1300) is located.\

0 commit comments

Comments
 (0)