# Getting started with policies

Policies organize traffic processing rules hierarchically, to make administration easier and to optimize traffic inspection performance.

## What policy elements do

- Firewall, IPS, and Layer 2 Firewall Policies contain the rules according to which the NGFW Engines allow or block traffic.
- Layer 2 Interface Policies contain rules according to which NGFW Engines in the Firewall/VPN role allow or block traffic detected by Capture Interfaces, Inline IPS Interfaces, and Inline Layer 2 Firewall Interfaces on NGFW Engines in the Firewall/VPN role.
- The same policy can be shared by several NGFW Engines that have the same role, several Master NGFW Engines, and several Virtual NGFW Engines that have the same role.
- Inspection Policies contain the rules according to which the NGFW Engines inspect traffic. The same Inspection Policy can be shared by several Firewall Policies, IPS Policies, and Layer 2 Firewall Policies.
  Note: Inspection Policies are not supported in Layer 2 Interface Policies.
- Each policy must always be based on a Template Policy. Template Policies contain rules that are inherited into any template or policy below it in the policy hierarchy.
- You can also insert Sub-Policies in your policies. A Sub-Policy is a set of IPv4 or IPv6 Access rules that can be matched conditionally to a restricted part of the traffic. Using Sub-Policies can improve processing performance. Sub-Policies can also enforce administrative boundaries.
- Policies can share Policy Templates and Sub-Policies. In shared rules, Alias elements can represent IP addresses that depend on the environment, so that the actual values are defined separately for each component.

## What do I need to know before I begin?

- Master NGFW Engines always use Firewall Policies, regardless of the role of the Virtual NGFW Engines they host.
- Virtual Firewalls use Firewall Policies.
- Virtual IPS engines use IPS Policies.
- Virtual Layer 2 Firewalls use Layer 2 Firewall Policies.