Exam NGFW-Engineer Topic 2 Question 53 Discussion

Establishing a functional IPSec VPN on a Palo Alto Networks Next-Generation Firewall requires addressing two distinct traffic flows: the management of the tunnel itself (Control Plane) and the transit of protected data (Data Plane).
First, to address the failure of the tunnel to establish, the firewall must have a security policy that permits the negotiation protocols. Specifically, a rule is required to allowike(UDP/500),ipsec-esp-udp(UDP/4500 if NAT- T is used), andipsec-esp(IP Protocol 50) between the source zone (where the firewall's public-facing interface resides) and the destination zone (where the partner's gateway resides). Since the firewall is the endpoint for this negotiation, the destination zone is often the "local" zone or the specific external zone where the peer's IP is located.
Second, once the tunnel is established, the firewall must be configured to allow the actual application traffic.
In the Palo Alto Networks zone-based architecture, traffic entering or exiting an IPSec tunnel is associated with aTunnel Interface. This interface must be assigned to a security zone. Because the default behavior for interzone traffic is to "Deny," the engineer must explicitly create a pair of security rules: one to allow traffic from the internal network zone to the tunnel interface's zone, and another to allow returning traffic from the tunnel interface's zone back to the internal zone. Without these rules, the tunnel may appear "active" in the logs, but all encapsulated production data will be dropped.