topic Re: Delete default "Internet" security zone in SCM in Strata Cloud Manager

Delete default "Internet" security zone in SCM

Justin.Morgan1 — Tue, 14 Oct 2025 01:32:44 GMT

I'm currently testing out SCM Pro with a lab firewall. So far I have been unable to delete the default "Internet" security zone which is set at the All Firewalls level. I get the following error message below

"A rule or another object is referencing internet. You can't delete objects that are in use. To delete an object, first remove it from the rules or other objects that are referencing it.

I've looked through the folders/snippets and can't find the relevant config to modify. Does anyone know how to do this?

Re: Delete default "Internet" security zone in SCM

henry567cowan — Tue, 14 Oct 2025 10:11:01 GMT

Hello @Justin.Morgan1,
To delete the default "Internet" security zone, you need to remove its references in other configurations. Based on the error message, the zone is being used in the SWG (Secure Web Gateway) general settings as the outbound zone.
Steps to resolve the issue:
Go to your NGFW configuration and navigate to ngfw-shared -> swg -> general-settings.
Change the outbound-zone setting to a different zone or none, depending on your requirements.
After updating the configuration, you should be able to delete the "Internet" security zone.
Additionally, ensure that there are no other rules or objects referencing the "Internet" zone. If you're still having trouble, review the Palo Alto Networks documentation or contact their support for more detailed guidance.

Best Regards,
Henry Cowan

Re: Delete default "Internet" security zone in SCM

Justin.Morgan1 — Tue, 14 Oct 2025 23:31:43 GMT

There's no option or panel to view ngfw-shared -> swg -> general-settings in our SCM.

Re: Delete default "Internet" security zone in SCM

Adrian_Inman — Fri, 02 Jan 2026 14:57:26 GMT

Literally got the same thing.

So... you likely do have this, but it isn't easy to find.

You need to go here:

Security Services, Internet Security

Then in the menu underneath the title Internet Security named Security Settings, Threat Management, DNS Security, Decryption, File Control and General will appear.

Hit General

and ta dah... There is the inbound and outbound zones...

Keep in mind that this is scope dependent so this exists at the Global level, but your zones may not...