If users are not prompted for authentication when accessing their Web servers despite an HTTP rule being created via User Authentication, the most plausible reason is that another rule exists in the Rule Base that accepts HTTP traffic without requiring authentication. In firewall rule processing, rules are evaluated in a sequential manner from top to bottom. Hence, if there is a preceding rule that allows HTTP traffic without authentication, it will take precedence, thus bypassing the User Authentication rule.