What is the default behavior of the Zone-Based Firewall (ZBFW) for traffic originating from the...

Comprehensive and Detailed Explanation

TheSelf-Zoneis a predefined security zone in the Prisma SD-WAN ZBFW that represents the ION device's own control plane and management traffic.

Default Rule:The security policy contains an implicit, uneditable default rule thatAllowstraffic originating from theSelf-Zoneto any destination zone (Internet, Private WAN, etc.).

Rationale:This ensures that the device can always perform essential critical functions—such as connecting to the Cloud Controller, resolving DNS, syncing time via NTP, and establishing VPN tunnels—without the administrator needing to manually create "Allow" rules for the device itself. If this traffic were blocked by a "Deny All" default, the device would become unmanageable (bricked) immediately after applying the policy.