https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210837#M61547 <P>Is it possible that the traffic which fall under the rule interzone-default get action ALLOW ?</P><P>How it is possible?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot_1.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/14787i41596BA3FF711AA4/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Screenshot_1.png" alt="Screenshot_1.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="policies-security.jpg" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/14788i7B3C60A8834CA6CB/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="policies-security.jpg" alt="policies-security.jpg" /></span></P> Wed, 18 Apr 2018 19:53:09 GMT Radmin_85 2018-04-18T19:53:09Z https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210837#M61547 <P>Is it possible that the traffic which fall under the rule interzone-default get action ALLOW ?</P><P>How it is possible?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot_1.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/14787i41596BA3FF711AA4/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="Screenshot_1.png" alt="Screenshot_1.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="policies-security.jpg" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/14788i7B3C60A8834CA6CB/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="policies-security.jpg" alt="policies-security.jpg" /></span></P> Wed, 18 Apr 2018 19:53:09 GMT https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210837#M61547 Radmin_85 2018-04-18T19:53:09Z https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210848#M61551 <P>It looks like your VSYS when you are looking at logging and the vsys when looking at the security policies do not match. Verify that the interzone-default throughout the VSYS associated in the traffic log is actually set to deny this traffic.&nbsp;</P> Wed, 18 Apr 2018 20:40:37 GMT https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210848#M61551 BPry 2018-04-18T20:40:37Z https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210900#M61553 <P>None of the vsys's interzone-default rule has allow option</P> Thu, 19 Apr 2018 06:15:10 GMT https://live.paloaltonetworks.com/t5/general-topics/is-it-possible/m-p/210900#M61553 Radmin_85 2018-04-19T06:15:10Z