Staff payroll is denied. The zone policy has a permit for that application below a deny-all, and the deny counter increases. Routes to the server exist. What is wrong with the policy?
Select an answer to reveal the explanation.
Short Explanation
The first rule says no, and your yes is written underneath where nobody looks. You move the payroll permit above the deny-all. The route is present, so the rising deny counter is the policy order and not a missing prefix.
Full Explanation
Zone-based and security rules stop at the first match. A deny-all above the payroll permit matches every session, increments the deny counter, and never reaches the permit. Move the permit ahead of the deny-all. The route to the server exists, so this is not a missing prefix, and a deny counter is exactly what a matching deny produces. A strict SLA would show an application-routing drop, not a hit on this deny rule. OMP did not withdraw the server. The users have a route, and a later permit does not cause a withdrawal. Exam caveat: after you reorder, confirm an earlier broader deny still does not catch payroll. The permit has to be the first match, not merely present. Operational check: a payroll session should increment the permit counter, and the deny-all counter should stop rising for that application.