Source and destination is APIPA or Soure is Legit machine and destination to Internet(zone) is APIPA

SIKRAM — Wed, 08 Apr 2026 17:55:39 GMT

In Palo Alto firewall we see legit source from zone inside to Internet zone send traffic to destination 168.254.x.x it's apipa ip. why do we see this traffic?

in some cases its from APIPA to APIPA IP.
or
Legit source to APIPA IP (internet zone)

Re: Source and destination is APIPA or Soure is Legit machine and destination to Internet(zone) is APIPA

abayoumi21 — Thu, 09 Apr 2026 09:27:35 GMT

This behavior is usually related to DHCP issues or endpoint network probing. Traffic to/from APIPA (169.254.0.0/16) should not normally reach the internet zone.

Explanation

If endpoints fail to obtain an IP address from DHCP, they may fall back to APIPA and attempt DHCP discovery or local communication. Due to the default route, this traffic can be forwarded toward the internet (untrust) zone and appear in the firewall logs.

In other cases, if the traffic is not DHCP-related, it may be generated by operating system probing or background network processes.

Recommendation

• Verify DHCP functionality and ensure endpoints can reach the DHCP server
• Investigate affected endpoints for misconfiguration
• Block APIPA traffic toward/from the internet zone as it is non-routable

Summary

APIPA traffic seen toward the internet zone is typically caused by DHCP failure or OS probing behavior. It is recommended to troubleshoot DHCP and block APIPA traffic at the firewall.

topic Source and destination is APIPA or Soure is Legit machine and destination to Internet(zone) is APIPA in Next-Generation Firewall Discussions

Source and destination is APIPA or Soure is Legit machine and destination to Internet(zone) is APIPA

Re: Source and destination is APIPA or Soure is Legit machine and destination to Internet(zone) is APIPA