View all questions & answers for the Palo Alto Next-Generation Firewall Engineer Exam Materials exam

Palo Alto Next-Generation Firewall Engineer Exam Materials - Question #78 Discussion

Comment Image Comment Image Comment Image

An engineer is configuring a site-to-site IPSec VPN to a partner network. The IKE Gateway and IPSec tunnel configurations are complete, and the tunnel interface has been assigned to a security zone. However, the tunnel fails to establish, and no application traffic passes through it once it is up. Which two Security policy configurations are required to allow tunnel establishment and data traffic flow in this scenario? (Choose two.) (Choose two answers)

  • A. A security rule is needed to allow IKE and IPSec traffic between the zone where the physical interface resides and the zone of the partner gateway.
  • B. A single bidirectional security rule must be configured to manage traffic flowing through the tunnel interface.
  • C. Security rules must be configured to permit application traffic from the local zone to the tunnel zone, and from the tunnel zone to the local zone.
  • D. An Application Override policy is needed to allow both the IKE negotiation and the encapsulated data traffic.
Correct Answer: A,C

Brave-Dump Community Votes

Answer: A, C (2 votes) 100%

Community Explanations & Comments (2)

Brave-Dumps.com Admin 10 months ago
Selected: A, C
It needs additional check from our experts
Ayesha 9 months ago
Selected: A, C
"A" security rule is needed to allow IKE and IPSec traffic between the zone where the physical interface resides and the zone of the partner gateway

"C" Security rules must be configured to permit application traffic from the local zone to the tunnel zone, and from the tunnel zone to the local zone.