Traffic is not hitting the corresponding security policy due to having dynamic-application statement set.

Issue reported is that traffic is not matching the correct security policy.

The security policy that was supposed to match the traffic in question had the "dynamic-application any" statement as match criteria. This statement refers to layer 7 applications; therefore, all traffic that does not contain a dynamic application (such as ping) will continue the security policy lookup until a match is found.

In addition, the security policy lookup order is also affected when you have unified policies (policies with dynamic applications) and standard policies configured. Usually, security policies are evaluated from top to bottom; but if there are different types of policies the order changes to the following:

1) Zone-based security policies without dynamic-applications

2) Zone-based security policies with dynamic-applications

3) Global policies without dynamic-applications

4) Global policies with dynamic-applications

5) Default policy

If the "dynamic-application" statement is deleted from the configured security policy, the correct security policy will be used to process traffic.