What is the default behavior of the Zone-Based Firewall (ZBFW) for traffic originating from the ION device itself (e.g., DNS queries, NTP sync, or Controller connectivity) destined for the "Internet" zone?

The Palo Alto Networks ION device's Zone-Based Firewall (ZBFW) has a set of implicit default rules to ensure essential device functionality. For traffic originating from the ION device itself (often referred to as the "local" or "self" zone), such as DNS queries, NTP updates, or connectivity to the Prisma SD-WAN controller, there is an implicit rule that allows this traffic to any destination zone. This ensures the device can maintain its management and operational connections without requiring an explicit security policy rule.

A. The default "Deny All" rule applies to traffic transiting between different zones (inter-zone traffic), not traffic originating from the device itself.
C. Controller connectivity and other essential services are designed to function over the configured WAN interfaces (circuits), not exclusively through a dedicated management interface.
D. This option uses non-standard terminology. The ZBFW operates with a unified local policy stack; there isn't a separate "Global" stack that bypasses local rules in this manner. ---

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the "Zone-Based Firewall" section, under the subsection "Default Security Rules," the documentation states: "Traffic that is sourced from the ION device (local) and destined for any other zone is allowed by default." This implicit rule is fundamental to the device's out-of-the-box operation. (Note: Specific page numbers vary by document version, but the information is consistently located in the ZBFW default rules description).