You can have multiple firewall policies assigned to a device in Security Director Cloud (SDC).
Each firewall policy has a sequence number associated with it which determines the order in which the rules will be installed in the firewall configuration.
The Preview configuration job shows that the deny rules associated with a firewall policy of higher sequence number is inserted before the permit rules associated with a firewall policy of lower sequence number.
The deploy firewall policy when run for the firewall policy with the higher sequence number pushes the above change to the device causing traffic to drop.
The deny rules associated with a firewall policy of higher sequence number is inserted before the permit rules associated with a firewall policy of lower sequence number.
This will cause a drop in the firewall traffic.
As part of policy performance improvements, there has been few changes in the way sequence numbers/positions are internally stored during policy preview/deployment. Previously sequence number was used for ordering whereas with new changes, an internal position is used. These changes have gone as part of 24.4 release(March 27th upgrade). From the job logs, it looks like this change is causing the ordering issues in cases where a device has multiple policies assigned and only 1 of the policies assigned to the device is updated and deployed after upgrade. The issue is not seen in case of devices which have one firewall policy assigned to them. If a device has multiple policies assigned to it and all the policies are chosen for the update, then the issue is not seen as well.
Lets say the device has 3 polices assigned in the order
1. A (Consists of permit rules)
2. B (Consists of permit rules)
3. C (Consists of deny rules)
After the upgrade of SDC instance to 24.4, since "A" was updated and deployed, SDC assigned a new sequence number for "A" bigger than the other 2 polices "B" and "C" and this caused the ordering issue wherein the deny rule got inserted before the permit rule.
Workaround:
There is a work around that can be applied to overcome this issue. If the customer selects all the 3 polices in the below order and deploys it to the device, we wont see the ordering issue( as this will regenerate the correct sequence numbers for all the 3 polices).
Note: This step needs to be performed(selection of all the 3 polices and deploy) only once and after successful initial deployment, for any future policy changes, only individual polices can be deployed.
The engineering team is already working on a permanent fix for this issue and the ETA for the same is the last week of April 2025.