Crazy policies needed for BGP and VPN

[Passepartout]

Hi,

first read this article:

https://live.paloaltonetworks.com/t5/Learning-Arti​cles/Any-Any-Deny-Security-Rule-Changes-Default-B...

then

 I have this exactly behavor but I don't have wrote any/any/deny rules!

In my enviroment both intrazone-default and interzone-default are blocked.

It's that the problem ? Bho?

To build a VPN with BGP proto inside, all traffic ipsec, and bgp is blocked by intrazone-default.

This policy resolve the problem:

"From PA to AWS tunnel VPN" {
        from UNTRUST;
        source 89.186.32.5;
        source-region none;
        to UNTRUST;
        destination [ 52.18.104.192 52.50.11.225 ];
        destination-region none;
        user any;
        category any;
        application/service [ ike/tcp/any/500 ike/udp/any/500
           ipsec-esp/50/any/any ipsec-esp-udp/udp/any/4500
           ipsec-esp-udp/udp/any/4501 ipsec-ah/51/any/any ];
        action allow;
        icmp-unreachable: no
        terminal yes;

"From PA to AWS BGP in tunnel VPN" {
        from VPN;
        source [ 169.254.20.78 169.254.21.22 ];
        source-region none;
        to VPN;
        destination [ 169.254.20.77 169.254.21.21 ];
        destination-region none;
        user any;
        category any;
        application/service [ bgp/tcp/any/179 bgp/udp/any/179 ];
        action allow;
        icmp-unreachable: no
        terminal yes;

[pankaku]

If you have modified your intrazone rule and made the action as deny so it means you have to create rule explicitly to allow intrazone traffic.

[Passepartout]

Dear Pankai,

 as you can see from this images, the traffic begin from same physical interface where is the destination....
what kind of intrazone traffic is that?

[pankaku]

IKE traffic UDP port 500 used for negotiating IPSec tunnels.

[jvalentine]

Intra-zone means "traffic within the same zone".  Inter-zone means "traffic between different zones".  The default policies for the intrA and intER-zone policies are the last two rules in your security policy:

Old(er) versions of PAN-OS do not show these intra/er-zone rules, but they still exist.  More recent versions show them.  The default is to permit traffic within the same zone (intrazone), and deny traffic between different zones (interzone).  You can override the default action either by editing these rules, or by creating an overriding rule above these default rules.