MENU
What is the default behavior of the Zone-Based Firewall (ZBFW) for traffic originating from the ION device itself (e.g., DNS queries, NTP sync, or Controller connectivity) destined for the "Internet" zone?
Comprehensive and Detailed Explanation
The Self-Zone is a predefined security zone in the Prisma SD-WAN ZBFW that represents the ION device's own control plane and management traffic.
Default Rule: The security policy contains an implicit, uneditable default rule that Allows traffic originating from the Self-Zone to any destination zone (Internet, Private WAN, etc.).
Rationale: This ensures that the device can always perform essential critical functions---such as connecting to the Cloud Controller, resolving DNS, syncing time via NTP, and establishing VPN tunnels---without the administrator needing to manually create 'Allow' rules for the device itself. If this traffic were blocked by a 'Deny All' default, the device would become unmanageable (bricked) immediately after applying the policy.