An engineer is configuring a site-to-site IPSec VPN to a partner network. The IKE Gateway and IPSec tunnel configurations are complete, and the tunnel interface has been assigned to a security zone…

Question

Options

• AA security rule is needed to allow IKE and IPSec traffic between the zone where the physical
• BA single bidirectional security rule must be configured to manage traffic flowing through the tunnel
• CSecurity rules must be configured to permit application traffic from the local zone to the tunnel
• DAn Application Override policy is needed to allow both the IKE negotiation and the encapsulated

• A
  74% (25)
• B
  18% (6)
• D
  9% (3)

Explanation

On Palo Alto Networks firewalls, IPSec VPN traffic has two distinct phases that traverse different interfaces, each requiring its own security policy. First, IKE negotiation (UDP 500/4500) and IPSec encapsulation/decapsulation (ESP/AH) occur on the physical interface-these packets travel between the zone of the physical (external) interface and the destination zone before the tunnel is established. Answer A addresses this: a security rule is required to allow IKE and IPSec protocols between the physical interface's zone and the partner. Second, once the tunnel is up, actual application traffic flows through the logical tunnel interface, which is assigned to its own security zone. Answer C addresses this: rules must permit traffic from the local (internal) zone to the tunnel zone (and a corresponding rule for the return direction). Answer B is incorrect because Palo Alto does not support a single bidirectional rule that covers both phases across different interface zones. Answer D is incorrect because Application Override policies bypass App-ID and are not appropriate or necessary for standard VPN establishment or encrypted data traffic.

No community discussion yet for this question.