Untrust to Untrust - Allow

[JoeAndreini]

My guess would be they wanted a logging profile on the default rules and did not know how to override them...

[ce1028]

---

@reaper wrote:

well their untrust untrust allow does not do anything in it's own as the default policy would already do what it does (allow intrazone traffic)

you could certainly rebuild that policy to only allow the applications you want, like ike and ipsec, and then set the default rule to drop instead of allow, or create a deny all rule for untrust at the end

---

The default rules don't do anything in this case because there is an explicit deny any rule above them.  The untrust -> untrust rule is above the deny all rule