By default, the interzone-default security policy rule on a Palo Alto Networks firewall is configured with an action of "deny" but has logging disabled. This is to prevent the firewall's log database from being overwhelmed by implicitly denied traffic. For an administrator to view traffic that matches this rule in the Monitor > Logs > Traffic section, they must first override the default rule and explicitly enable the "Log at Session End" option within the rule's "Actions" tab.

A. While the traffic is indeed denied by default, this fact does not explain the absence of log entries. Denied traffic is logged if the rule is configured to do so.

B. A Log Forwarding profile is used to send logs to external collectors (e.g., Panorama, Syslog). Its absence does not prevent logs from being generated locally on the firewall.

C. The interzone-default policy is enabled by default. It serves as the final, implicit rule for all traffic between different security zones that is not explicitly allowed.

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Security Policy

" section "Default Security Rules." The documentation states

"By default

the intrazone-default and interzone-default rules are configured with the Log at Session End option disabled." (p. 598)

2. Palo Alto Networks

Firewall Essentials: Configuration and Management (EDU-210) Student Guide

Module 4: "Security Policy." The courseware explains that the two default rules

intrazone-default and interzone-default

do not log traffic by default and must be overridden to enable logging for troubleshooting purposes.

3. Palo Alto Networks

PCNSA Study Guide

"Domain 2: Core Concepts

" section "Security Policies." The guide clarifies the behavior of default security rules

noting

"The two predefined rules do not log any traffic by default." (p. 56)