Rules work in the following ways, depending on the type of information in the packet, and the number of criteria in the rule:
L4 rules with a Permit operation are applied to non-initial fragments
L4 rules with a Deny operation are not applied to non-initial fragments, and the device continues checking the next IP rule. This is to prevent cases in which fragments that belong to other L4 sessions may be blocked by the other L4 session which is blocked.
L3 rules apply to non-initial fragments
L3 rules that include the fragment criteria do not apply to initial fragments or non-fragment packets
L3 rules that do not include the fragment criteria apply to initial fragments and non-fragment packets
L4 rules apply to initial fragments and non-fragment packets
