To ensure predictable results,
we recommend marking traffic using either security policies in Prisma
Access or your on-premises device, but not both. If there are differences
between the security policies in Prisma Access and the on-premises
device, the security policy in Prisma Access overrides the policy
in the on-premises device.