Source and destination is APIPA or Soure is Legit machine and destination to Internet(zone) is APIPA

[SIKRAM]

In Palo Alto firewall we see legit source from zone inside to Internet zone send traffic to destination 168.254.x.x it's apipa ip. why do we see this traffic?

in some cases its from APIPA to APIPA IP. 
or 
Legit source to APIPA IP (internet zone)

[abayoumi21]

This behavior is usually related to DHCP issues or endpoint network probing. Traffic to/from APIPA (169.254.0.0/16) should not normally reach the internet zone.

Explanation

If endpoints fail to obtain an IP address from DHCP, they may fall back to APIPA and attempt DHCP discovery or local communication. Due to the default route, this traffic can be forwarded toward the internet (untrust) zone and appear in the firewall logs.

In other cases, if the traffic is not DHCP-related, it may be generated by operating system probing or background network processes.

Recommendation

• Verify DHCP functionality and ensure endpoints can reach the DHCP server
• Investigate affected endpoints for misconfiguration
• Block APIPA traffic toward/from the internet zone as it is non-routable

Summary

APIPA traffic seen toward the internet zone is typically caused by DHCP failure or OS probing behavior. It is recommended to troubleshoot DHCP and block APIPA traffic at the firewall.