When Wildcard Objects are used, the traffic does not match the correct policy.

The traffic is not taking the expected rule with wildcard object.

Given the configuration below:

Traffic from 10.128.0.1 match the 3 wildcard objects, however, it is being processed by the rule C.

admin@NGFW> test security-policy-match from Trust to Untrust source 10.128.0.1 destination 8.8.8.8 destination-port 80 protocol 6

"Rule C; index: 3" {
        from any;
        source none;
        source-region none;
        to any;
        destination any;
        destination-region none;
        user any;
        source-device any;
        destination-device any;
        category any;
        application/service 0:any/any/any/app-default;
        action allow;
        icmp-unreachable: no
        terminal yes;
}

• Palo Alto Firewalls
• Supported PAN-OS
• Wildcard object

• In case of overlapping wildcard objects, the address is matched against the longest prefix wildcard mask (see additional information). 
• In this example, 
  • For the IP address 10.128.0.1.
  • The leaf matched is 10.128.0.1/12 (/12 is longer than /9).
  • Then the IP address is matched against wildcard-10.128.0.1-0.15.255.0 which is used in Rule C.

1. Shift the rules in correct order to get the intended results
2. See the calculation for the above example below
   1. For the above example Review the wildcard objects so the prefix length match is neutralized (step1).

For the IP address 10.128.0.1.
Because 10.128.0.1 matched the leaf 10.128.0.1/12, the other wildcard objects need to be edited to result in /12 prefixes.
 
The object wildcard-10.128.0.1-0.127.0.0 - 10.128.0.1/0.127.0.0 needs to be decomposed in the wildcard as below.

• 10.128.0.1/0.15.0.0
• 10.144.0.1/0.15.0.0
• 10.160.0.1/0.15.0.0
• 10.176.0.1/0.15.0.0
• 10.192.0.1/0.15.0.0
• 10.208.0.1/0.15.0.0
• 10.224.0.1/0.15.0.0
• 10.240.0.1/0.15.0.0

After the change, the rule is matched as expected

admin@NGFW> test security-policy-match from Trust to Untrust source 10.128.0.1 destination 8.8.8.8 destination-port 80 protocol 6

"Rule A; index: 1" {
        from any;
        source none;
        source-region none;
        to any;
        destination any;
        destination-region none;
        user any;
        source-device any;
        destination-device any;
        category any;
        application/service 0:any/any/any/app-default;
        action allow;
        icmp-unreachable: no
        terminal yes;
}

1. Prefix length match
   In this stage, for a given address, the system will search for the longest prefix match on the Data Structure to get the list of wildcard objects.
2. Associated wildcard object match
   In this stage, for a given address, the system will check the match with the associated wildcard objects.