Zone Protection on GlobalProtect Zone

[umar00o]

Dear Team,

I have a question do you recommend putting Zone protection on the Zone which I have for GP. I am using loopback External IP for the connection and in the GP Zone I have added the tunnel interface. 

Just want to understand if best practice to put zone protection on this zone?

Thanks

[batd2 · Accepted solution]

@umar00o The general Palo Alto best practices recommendation is to apply zone protection to all zones, however realistically there is no much use for ZP on it.This is just a virtual interface used only for the GP tunnel binding and there will not be much of benefit in using zone protection. 

[umar00o · Accepted solution]

Hi Batd2,

Thank you very much for the clarificatoins.

Thanks