The packet-processing order follows a logical sequence from initial ingress to deep content inspection.

1. Zone Protection: This is one of the first actions performed during the ingress stage. It protects the firewall itself by applying rules to traffic based on its source zone before a session is established.
2. Decryption: After the initial policy lookup determines that traffic should be decrypted (e.g., SSL/TLS), the firewall decrypts the payload. This step is necessary to gain visibility into the encrypted application data.
3. App-ID: Once the traffic is decrypted and the payload is visible, the App-ID engine inspects the data to identify the specific application, shifting from port-based to application-based identification.
4. Security Profile Enforcement: After the application is identified, the firewall applies the relevant security profiles (e.g., Antivirus, Anti-Spyware, Vulnerability Protection) to the traffic for content inspection and threat prevention.

Palo Alto Networks, PAN-OS® Administrator’s Guide 10.2.

Section: Networking > Packet Flow Sequence in PAN-OS

Details: The documentation provides a detailed diagram and explanation of the "Life of a Packet." It explicitly shows Zone Protection occurring in the initial ingress stage (Stage 1). It then details the slow path (session setup), where policy lookup triggers decryption (Stage 6), followed by application identification (App-ID) (Stage 8), and finally, content inspection/security profile enforcement (Stage 9).

Palo Alto Networks Live Community, "The Life of a Packet."

Document: This resource provides a simplified and graphical representation of the packet flow. It confirms that ingress processing, including zone protection, happens first. It is followed by session setup, which involves policy evaluation that can trigger decryption, then App-ID, and subsequently content scanning via security profiles.