Hello,
I am reading the Access Policy documentation and I can see it states the following:
“As soon as it finds a policy that matches the criteria that was specified in a rule, it enforces that policy rule and disregards all other rules that follow, including any potentially conflicting rules”
There is another part of the documentation however that states this:
“If application segments are part of the criteria, then ZPA chooses the rule corresponding to the most specific application segment for a given domain name or IP address”
These two statements are in the policy evaluation help page shown here: About Policies | Zscaler
But they seem to contradict one another, It sounds like it is a top down evaluation for app segments that do not conflict, but when a rule set exists where there are conflicts (for example a specific FQDN at bottom of the list with a wildcard on top of the list), then it reverts to a most-specific-match, and top wildcard would be ignored?
Is this correct, is that also the case when using segment groups vs application segments on the access policy?