If a user or user group is associated with multiple policies, the policies are matched in a particular order. Overlay policies are matched from the top down. For non-overlay policies, only the first valid policy is matched.

Overlay policies include Access Control, port control, web keyword filtering, web file type filtering, QQ number whitelist, flow quota, Internet access online duration quota, traffic rate limit, concurrent connection limit, Ingress policies, and application audit. The following figure shows the matching sequence of Internet access permission policies.

Other overlay policies are matched from the top down.

Non-overlay policies include proxy control, SSL content identification, mail filtering, Flow/Online Duration, webpage content audit, Bulletin Board, and online endpoints. The first valid non-overlay policy prevails.

If the sequence of policies in the Policies is adjusted, the policy sequence on the page displayed after you choose Users > Policies is changed accordingly.