Zscaler Policy Enforcement Order: How Rules Are Evaluated

Zscaler applies policy in two layers. The modules run in a fixed order you cannot change, and inside each module your rules run top to bottom by rule number. The first rule that matches ends the check for that module.

This matters because a block early in the chain stops everything after it. A firewall rule that drops a port is never seen by URL filtering.

The Two Kinds of Order

The first kind is module order. Zscaler decides which engine inspects the traffic first. That sequence is built into the service.

The second kind is rule order inside one policy. Every rule has a number. Zscaler reads rule 1, then rule 2, and stops at the first rule whose criteria match.

Each policy also ends with a default rule. If no numbered rule matches, the default rule decides. A policy is never silent.

Two overlapping rules are not both applied. The lower number wins. So a broad allow rule placed at number 3 can make rules 4 through 20 unreachable for that traffic.

Zscaler Internet Access (ZIA) Order

ZIA inspects traffic going to the internet and to SaaS applications. The modules run in this sequence.

Step	Policy	What it decides
1	Client Connector forwarding profile	Whether traffic is sent to Zscaler or bypassed
2	Authentication	Which user and group the traffic belongs to
3	Cloud Firewall and DNS Control	Allow or block by IP, port, protocol or DNS request
4	SSL/TLS Inspection	Whether the session is decrypted
5	Threat protection	Blocks known malicious URLs and content
6	Cloud App Control	Allow, block or limit a named cloud application
7	URL Filtering	Allow or block by URL category
8	Bandwidth Control	Caps how much bandwidth a class of traffic may use
9	File Type Control	Allows or blocks uploads and downloads by file type
10	Malware protection	Scans content against known malware signatures
11	Data Loss Prevention	Blocks sensitive data from leaving the company
12	Sandbox	Holds and detonates unknown files before delivery

Two details in this table surprise people.

Cloud App Control runs before URL Filtering. A block on a named application therefore beats an allow on the URL category that contains it.

SSL inspection sits above every web policy. If a session is not decrypted, the later modules only see the domain, not the full URL or the file.

The service also stops at the first violation. Once one module blocks a transaction, the remaining modules are skipped.

Zscaler Private Access (ZPA) Order

ZPA controls access to private applications inside your own network. It has a separate chain.

Step	Policy	What it decides
1	Client Forwarding Policy	Whether the request goes through ZPA or bypasses it
2	Access Policy	Whether this user may reach the application segment
3	Timeout Policy	How long a session lasts before the user re-authenticates
4	Inspection and Isolation	Whether allowed traffic is inspected or opened in isolation

ZPA first matches the most specific application segment. Client forwarding is evaluated next, and the access policy only after that.

A Short Worked Example

A user tries to upload a 30 MB file to a personal cloud drive.

The firewall allows port 443. SSL inspection decrypts the session. Cloud App Control matches the named drive and blocks the upload.

URL Filtering, File Type Control and DLP never run. The transaction already ended at step 6.

Change one thing and the result changes. If SSL inspection excludes that domain, Cloud App Control cannot see the application name, and the upload succeeds.

How to Prepare

Learn the module order before the rule syntax. Most misconfigurations come from placing a control in a module that runs too late.
Check rule numbers every time you add a rule. A new allow rule near the top silently disables specific blocks below it.
Trace one real transaction end to end. Follow it through forwarding, firewall, inspection and the web modules, and note where it stops.
Practice describing layered security controls. Ordered policy chains appear in many design questions, and Grokking System Design Fundamentals covers the building blocks.
Prepare for the rest of the loop. See the common Zscaler behavioral questions and how long it takes to hear back after a Zscaler interview.