Missing Security Policy for VPN Traffic: Tunnel Up but No Data Flow
Exhibit
Refer to the exhibit. show vpn gateway Name: Corp-GW Peer IP: 203.0.113.1 Local IP: 198.51.100.1 IKE version: IKEv2 Pre-shared key: **** IKE crypto profile: default DPD: enabled show vpn tunnel Name: Corp-Tun Tunnel interface: tunnel.1 Type: IPSec IKE gateway: Corp-GW IPSec crypto profile: default Proxy IDs: local 10.0.0.0/16, remote 172.16.0.0/16 show routing route Destination: 172.16.0.0/16 Next hop: tunnel.1 Metric: 10 show interface tunnel.1 Interface: tunnel.1 Zone: VPN-Zone Virtual router: default
Refer to the exhibit. A site-to-site VPN is configured between two branches. The tunnel is up but traffic is not passing. What is the most likely issue?
Quick Answer
The correct answer is a missing security policy for the VPN zone because it highlights a distinction that trips up a lot of people studying site-to-site VPNs: a tunnel being 'up' only means the IKE and IPsec security associations have successfully negotiated, which is a control-plane achievement. It says nothing about whether the firewall will actually forward the decrypted traffic once it arrives. The dataplane still evaluates every packet coming off that tunnel against the security policy, using the tunnel interface's assigned zone as the source zone, just as it would for any other interface. If no rule permits traffic from that VPN zone to the destination zone, the firewall drops the traffic even though the tunnel itself is perfectly healthy. This is why 'tunnel up, traffic not passing' is such a common troubleshooting scenario: administrators check tunnel status, see everything looks fine, and overlook that policy enforcement is a completely separate step from tunnel establishment. Whenever a question describes a VPN, GRE, or other tunnel interface as up and stable but traffic still failing to pass, your first instinct should be to check whether a security policy actually permits traffic to and from that tunnel's zone, rather than digging further into the tunnel negotiation itself.
⚠ Common exam trap
Palo Alto Networks often tests the misconception that a tunnel being up automatically means traffic will pass, but Palo Alto Networks requires an explicit security policy to permit decrypted traffic from the VPN zone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No security policy allows traffic from the VPN zone.
When a site-to-site VPN tunnel is up but traffic is not passing, the most common cause is the absence of a security policy that permits traffic from the VPN zone to the destination zone. Even if IKE and IPsec SAs are established, the firewall drops the decrypted traffic if no rule explicitly allows it. This is a fundamental Palo Alto Networks concept: tunnel establishment and data forwarding are separate control and data plane functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IKE gateway is not configured with the correct peer IP.
Why it's wrong here
The peer IP is configured.
- ✓
No security policy allows traffic from the VPN zone.
Why this is correct
Even though the tunnel is up, traffic can be blocked by security policy if no rule permits it.
- ✗
The proxy IDs do not match the remote peer.
Why it's wrong here
The proxy IDs show correct local and remote subnets.
- ✗
The tunnel interface is not assigned to a zone.
Why it's wrong here
The tunnel interface is in zone VPN-Zone.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNSE question from scratch — 504 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A small company has two sites connected by a policy-based IPsec VPN. Users at Site B report they cannot reach a server at Site A with IP 10.1.1.100. The firewall administrator checks the VPN monitor and sees the tunnel is active and IKE SAs are up. From the Site B firewall, a ping to 10.1.1.100 succeeds. However, a user on a PC (192.168.50.10) behind the Site B firewall cannot ping 10.1.1.100. The security policy on the Site B firewall allows traffic from trust to VPN zones. What is the most likely cause of the issue?
easy- ✓ A.The security policy on Site B does not include the user subnet as a source VPN zone traffic
- B.NAT is translating the user's IP to an incorrect address
- C.The IPsec tunnel has a misconfigured proxy ID
- D.The Site A firewall has a route missing for the Site B user subnet
Why A: The security policy on Site B must explicitly include the user subnet (192.168.50.0/24) as a source in the rule that permits traffic to the VPN zone. Even though the tunnel is up and the firewall itself can reach 10.1.1.100 (bypassing policy checks), user traffic is subject to security rules. Without the user subnet as a source, the policy drops the traffic, causing the connectivity failure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.