All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security policy rules that permits only this type of access…

Setting Service to "application-default" means the firewall will use the standard port(s) associated with the application identified in the "Application" field, which for Telnet is TCP 23. This ensures that only Telnet traffic on its default port is allowed.

While "service-telnet" might seem intuitive, Palo Alto Networks security policies prioritize App-ID, and using "application-default" with "Application = Telnet" is the recommended way to ensure Telnet on its standard port.

Setting Application to "Telnet" leverages Palo Alto Networks' App-ID technology to identify Telnet traffic regardless of the port it uses, ensuring only actual Telnet application traffic is permitted. This provides more granular control than relying solely on ports.

Setting Application to "any" would allow all types of applications, violating the requirement to permit *only* Telnet access and compromising security.