A network security engineer has created a Security policy in Prisma Access that includes a negated region in the source address. Which configuration will ensure there is no connectivity loss due to the negated region?

When a Security policy uses a negated region in the source address (e.g., "NOT Europe"), it explicitly excludes traffic originating from that region from matching the rule. According to the top-down policy evaluation logic, traffic from the negated region will bypass this rule. If no subsequent rule explicitly allows this traffic, it will be denied by the default interzone-deny rule at the end of the policy set, causing a connectivity loss for users in that region. To prevent this, a separate Security policy must be created that specifically matches traffic from the negated region to an appropriate destination, thereby ensuring it is permitted.

A. Set the service to be application-default. This option configures the service/port for an application and does not affect how the firewall matches the source address of a packet.
C. Add a Dynamic Application Group to the Security policy. A Dynamic Application Group is used to match traffic based on the application, not the source region or IP address.
D. Add all regions that contain private IP addresses to the source address. This action is irrelevant to the problem, which concerns a negated public region. It would not resolve the connectivity issue for users in that specific negated region.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2: In the section "Policies > Security," the guide explains the top-down evaluation of Security policy rules. It states, "The firewall evaluates policy rules in order, from top to bottom. When it finds a rule that matches the traffic, it applies the rule action and does not evaluate any subsequent rules." This principle confirms that traffic not matching a rule (due to negation) will fall through to the next rule, and if no match is found, it will be denied by the default rule.

2. Palo Alto Networks Prisma Access Administrator's Guide: The "Get Started with Security Policy" section details the components of a Security policy rule, including Source, Destination, and Application. The logic for creating and ordering rules to avoid unintended blocks is consistent with the PAN-OS platform. Using a negated source requires a complementary rule for the negated object to ensure it is handled correctly and not implicitly denied.

3. Palo Alto Networks TechDocs - Objects > Address Objects: The documentation on Address Objects explains the use of negation. It clarifies that negating an object in a policy rule means the rule will apply to any address except the one specified. This directly implies the need for a separate policy to handle the excluded address to prevent it from being dropped.