Unlike actions, the Use Next Policy statement does not terminate the evaluation process. Figure 4-5 depicts the conditions and actions that are availble within the Policy Builder control of the Centri Firewall user interface. The Use Next Policy statement brings us to the important concept of policy inheritance. Policy inheritance does not have a counterpart within our Caller ID analogy, but it is an important concept to understand before you can develop effective network security polices. Policy inheritance refers to Cisco Centri Firewall's ability to use recursive lists of security policies.
Dominance is an attribute of the lowest node to which a security policy is applied.
If the parameters of a session request match two security policies within a direct path, the one applied to the lowest node in that path is applied to that session. Security Policy Inheritance in Cisco Centri Firewall Note Policy inheritance provides for flexible design and enforcement of an organization's network security policy. It also eases the burden of managing large networks. Within the Cisco Centri Firewall user interface, the rules for policy inheritance are processed according to the layout of the Networks tree. The benefit of policy inheritance is most obvious when managing large networks, multiple departments, or numerous users and workstations requiring special privileges.