Which two statements apply to configuring required security rules when setting up an IPSec tunnel between a Palo Alto Networks firewall and a third- party gateway? (Choose two.)

When configuring an IPSec VPN on a Palo Alto Networks firewall, payload traffic passing through the tunnel typically moves between an internal zone (e.g., Trust) and a dedicated VPN zone. Because this constitutes interzone traffic, the default interzone-deny policy applies, making it mandatory to create explicit security rules for both incoming and outgoing directions. Conversely, the IKE negotiation (UDP 500/4500) and IPSec/ESP encapsulation packets occur between the public IP addresses of the local firewall and the third-party peer gateway. Since both the source and destination for this negotiation reside in the same external zone (typically Untrust), this traffic is automatically permitted by the firewall's built-in intrazone-default allow policy. Therefore, no explicit rules are required for the VPN establishment itself, only for the payload.

A: Traffic through the tunnel crosses different zones (e.g., Trust to VPN). The default interzone deny policy applies, making explicit bidirectional rules mandatory, not optional. D: IKE and ESP packets terminate on the physical interface. Since the peer and local interfaces share the same external zone, the traffic is intrazone (allowed), not interzone.

1. Palo Alto Networks. PAN-OS 11.0 Administrator's Guide. Section: "Set Up Site-to-Site VPN" -> "Site-to-Site VPN Overview". (Details the requirement for bidirectional security policies for tunnel payload traffic).

2. Palo Alto Networks. PAN-OS 11.0 Administrator's Guide. Section: "Policies" -> "Security Policy Rules" -> "Default Rules". (Explains the intrazone-default allow behavior applicable to IKE/IPSec traffic terminating on the same external zone).

3. Palo Alto Networks Education Services. Firewall Essentials: Configuration and Management (EDU-210). Module: "Site-to-Site VPNs". (Explicitly confirms IKE negotiation and IPSec/ESP packets are allowed by default via the intrazone default allow policy).