Site 2 Site VPN - Rule placement

[nflnetwork29]

What is the best practice for vpn tunnel rule placement? Should it go at the very top of my firewall policy ?

Above or below my stealth rule? Does it matter?

[the_rock]

I would say towards the top, I always found works best, just to be safe.

[Vladimir]

I do not think that it should matter, since VPNs are governed by VPN Communities and implied rules.

Decrypt is happening  before access control policy and encrypt after.

[the_rock]

Thats true, you are 100% correct. I still personally prefer to put them towards the top of the rulebase.