When adding authentication to a security policy, you can add multiple authentication rules, or sub-policies. Within these policies you can include additional security profiles, traffic shaping and so on, to take affect on the selected services.

These sub-policies work on the same principle as normal security policies, that is, top down until the criteria has been met. As such, if there is no matching policy within the list, the packet can still be dropped even after authentication is successful.