PAN OS 10, Two devices on different subnets in the same zone

[MantaIT]

We are running a Palo 5220. If we setup two different virtual interfaces with two different IP subnets in the same zone. Will I need to setup security policies to allow the two different subnets in a single zone to communicate. or will the Palo route traffic between subnets in the same zone with out any additional security policies?  

[BPry · Accepted solution]

@MantaIT,

By default, you wouldn't need to do anything to allow this traffic. It'll be caught by the intrazone-default policy and allowed without any action on your end. 

[MantaIT]

Thank you very much, that was my thought, but it was not unanimous in our group. We are planning on setting up a test in our lab also, but I thought I could get a quick reply here also. You were a huge help. Thank you. 

[emolina007]

I have a server subnet and a workstation subnet server subnet that we only want to specify communication from server to workstation and vise versa. Would a universal zone work just fine or should we create a server zone and workstation zone and then apply ACL communication? Is there a way to setup a zone with two different subnets in it and not have them talk, only thru ACL allow policy?