An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration. What should the administrator do?

By default, the predefined intrazone-default security policy rule in PAN-OS is configured to allow traffic but has logging disabled. To troubleshoot which specific traffic sessions are matching this rule, an administrator's first step must be to gain visibility. This is achieved by modifying the rule to enable logging (e.g., "Log at Session End"). Once logging is enabled, new sessions matching the rule will be recorded in the Traffic Log, allowing for proper analysis and troubleshooting. Without this change, no log data for the traffic in question will be generated.

B. review the System Log: The System Log tracks administrative and system-level events, not traffic flow. It is irrelevant for identifying sessions matching a security rule.
C. refresh the Traffic Log: Refreshing the Traffic Log will not display any new information if log generation for the matching rule is disabled.
D. tune your Traffic Log filter to include the dates: Adjusting filters is ineffective if the logs are not being created in the first place due to the rule's default logging configuration.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Security > Security Policy > Default Security Policy Rules

" the documentation states

"The two predefined rules (intrazone-default and interzone-default) are initially set to allow traffic

but they do not log traffic by default." This confirms that logging must be explicitly enabled for troubleshooting.

2. Palo Alto Networks Knowledge Base

Article ID: 2683: The article titled "How to Enable Logging on Default Security Rules" explicitly states: "By default

the intrazone-default and interzone-default security rules do not have logging enabled. To see traffic that is hitting these rules

logging must be enabled." This directly supports changing the logging action as the correct procedure.