Prefilter vs access control policy

Prefilter and access control policies both allow you to block and trust traffic. In a prefilter policy, the "trust" functionality is called "fastpathing" because it skips more inspection. If you do not configure a custom prefilter policy, you can only approximate, but not replicate, prefilter functionality using Block and Trust rules placed early in the access control policy.


Characteristic	Prefilter Policy	Access Control Policy
Primary function	Quickly fastpath or block certain types of plaintext or passthrough tunnels, or tailor subsequent inspection to encapsulated traffic. Fastpath or block any other connections that benefit from early handling.	Inspect and control all network traffic, using simple or complex criteria, including contextual information and deep inspection results.
Sequence within access control	First The system matches traffic to prefilter criteria before all other access control configurations. Thus, fast-pathing in a prefilter policy skips many other policies and inspections.	Last Other policies that might inspect a connection, including Security Intelligence and decryption, are applied before access control rules are evaluated.
Rule actions	Fewer You can stop further inspection (Fastpath and Block) or allow further analysis with the rest of access control (Analyze).	More Access control rules have a larger variety of actions, including monitoring, deep inspection, block with reset, and interactive blocking. See Access control rule actions.
Bypass capability	Fastpath rule action Fastpathing traffic in the prefilter stage bypasses all further inspection and handling. This includes: Security Intelligence User identity discovery (identity policy) Decryption Access control rules Deep inspection of packet payloads Discovery Rate limiting	Trust rule action Traffic trusted by access control rules is only exempt from intrusion inspection and discovery. If another policy that requires inspection is applied to a connection that is eventually trusted, the connection is inspected anyway. Trust means that intrusion and file policies are not applied to the connection.
Rule criteria	Limited Rules in the prefilter policy use simple network criteria: IP address, VLAN tag, port, and protocol. For tunnels, tunnel endpoint conditions specify the IP address of the routed interfaces of the network devices on either side of the tunnel.	Robust Access control rules use network criteria, but also user, application, requested URL, and other contextual information available in packet payloads. Network conditions specify the IP address of source and destination hosts.
IP headers used (tunnel handling)	Outermost Using outer headers allows you to handle entire plaintext, passthrough tunnels. For nonencapsulated traffic, prefiltering still uses "outer" headers—which in this case are the only headers.	Innermost possible For a nonencrypted tunnel, access control acts on its individual encapsulated connections, not the tunnel as a whole. See How the system processes plain-text tunnels.
Rezone encapsulated connections for further analysis	Rezones tunneled traffic Tunnel zones allow you to tailor subsequent inspection to prefiltered, encapsulated traffic.	Uses tunnel zones Access control uses the tunnel zones you assign during prefiltering. See Using tunnel zones to apply access control at the tunnel level.
Connection logging	Fastpathed and blocked traffic only. Allowed connections may still be logged by other configurations.	Any connection