2.4 Inline Layers and Nested Rule Matching

What an Inline Layer Is

An inline layer is a sub-rulebase embedded inside a single rule of an ordered layer. Instead of taking a terminal action like Accept or Drop, the parent rule invokes the inline layer; evaluation drops into the inline layer's own rules, which are evaluated top-down with first-match-winner semantics. The action of the inline rule that matches becomes the effective action of the parent rule for that connection.

Inline layers let administrators group related rules under a common scope without flattening them into the parent ordered layer. A single inline layer can also be invoked from multiple parent rules, enabling reuse.

Why Inline Layers Exist

Without inline layers, every rule that shares a common parent match (for example, all traffic from a partner network) would have to repeat that match in each rule. The rulebase becomes long, repetitive, and error-prone: change the partner subnet and you touch ten rules instead of one. Inline layers solve this by hoisting the common match into one parent rule and grouping the specific variations inside the inline layer.

For example, suppose a partner network 10.20.30.0/24 needs different rules for HTTP, SSH, and database access. Instead of three rules in the main Network layer, each with source 10.20.30.0/24, you create:

• Parent rule (Network ordered layer): Source 10.20.30.0/24, Destination Any, Service Any, Action: invoke inline layer Partner-Access.
• Inline layer Partner-Access with three rules:
  • Rule 1: Source 10.20.30.0/24, Destination Web-Servers, Service http, Action: Accept.
  • Rule 2: Source 10.20.30.0/24, Destination DB-Servers, Service sqlnet, Action: Accept.
  • Rule 3: Source 10.20.30.0/24, Destination Any, Service Any, Action: Drop (inline cleanup).

To change the partner subnet later, you edit only the parent rule.

Evaluation Model

The evaluation flow for an inline layer is:

1. The gateway evaluates the parent ordered layer top-down.
2. If a rule with an inline layer matches, the gateway enters the inline layer.
3. Inside the inline layer, rules are evaluated top-down and the first match wins.
4. The action of the matching inline rule becomes the effective action of the parent rule.
5. If no rule in the inline layer matches, the inline layer's default action is applied.
6. The effective action then flows back to the parent rule's slot in the ordered layer: a Drop stops further Access Control evaluation; an Accept typically continues to the next ordered layer.

This nesting is one level deep by default: an inline layer is invoked from an ordered layer, not from another inline layer. Deep nesting is generally not used because it makes the rulebase hard to read and audit.

Inline Layer vs Ordered Layer

The key distinctions:

Both use top-down first-match evaluation. The structural difference is where the layer sits in the policy tree.

Sharing Inline Layers

Inline layers can be shared. A shared inline layer can be invoked from multiple parent rules, even across ordered layers. This lets administrators define a common rule group once (for example, a Block-Known-Bad-Domains rule set) and call it from several parent rules. The first-match rule still applies inside the shared inline layer for each invocation.

When the same inline layer is invoked from multiple parent rules, each invocation is independent: a connection that matches parent rule A enters the inline layer fresh, and a connection that matches parent rule B also enters the inline layer fresh. The two invocations do not share state.

Default Actions and Cleanup Inside Inline Layers

Every inline layer has a default action taken when no inline rule matches. Best practice is to set the inline layer default to a value that fails closed — typically Drop — so traffic that enters the inline layer but matches no specific rule is denied, not allowed. A cleanup rule at the bottom of the inline layer (with Action Drop or Log) makes this explicit and visible in the rulebase.

If you set the inline layer default to Accept, any traffic matching the parent rule but no inline rule is accepted — usually a mistake. Read the inline layer's default action when interpreting scenarios.

Inline Layers in the R82 SmartConsole

In SmartConsole, an inline layer appears as a sub-rulebase under the parent rule. The parent rule's action column shows the inline layer's name rather than a terminal action. Double-clicking the inline layer opens its rules in the same pane, with the parent rule's context visible. The inline layer has its own rule numbers, its own default action, and its own enable/disable flags per rule.

Common Exam Scenarios

CCSA R82 inline-layer questions usually test one of these:

• Recognizing that an inline layer is invoked, not bypassed. A parent rule with an inline layer does not have a terminal action — it routes the connection into the inline layer. Selecting the parent rule's action as the connection's outcome is wrong.
• First match inside the inline layer. Just like an ordered layer, the first matching inline rule wins. A broad Accept above a specific Drop shadows the Drop.
• Inline default action. If no inline rule matches, the inline layer's default applies, not the parent's. The default is often Drop; if it is Accept, traffic is allowed.
• Reuse. A shared inline layer called from two parent rules behaves identically in each invocation; changes to the inline layer apply to both invocations.

Best Practices

• Keep inline layers shallow — one level of nesting, a small number of rules per inline layer.
• Fail closed — set the inline layer default to Drop and add a visible cleanup rule.
• Name inline layers descriptively — Partner-Access, DMZ-Inbound, Block-Bad-Domains are easier to audit than Inline1.
• Use inline layers for grouping, not for broad access. A parent rule that matches Any/Any/Any and invokes an inline layer effectively moves the rulebase into the inline layer; the ordered layer becomes a pass-through.

Why This Matters for the Exam

Inline layers test whether you understand that the Access Control policy is a tree, not a flat list. When a parent rule invokes an inline layer, follow the connection into the inline layer, evaluate top-down, and apply the first match. The inline layer's matched action is the effective action of the parent rule.