A. When a policy match is found in a local firewall policy, if any Panorama shared post-rule is configured, it will still be evaluated.

B. Local firewall rules are evaluated after Panorama pre-rules and before Panorama post-rules.

C. Panorama post-rules can be configured to be evaluated before local firewall policy for the purpose of troubleshooting.

D. The order of policy evaluation can be configured differently in different device groups.