What kind of security policy should I configure for LSVPN termination?

The LSVPN documentation mentioned "If you created a separate zone for tunnel termination of VPN connections, create a security policy to enable traffic flow between the VPN zone and your trust zone." but it doesn't provide specific examples. What should I configure exactly?

NGFW (all models)

PANOS (all versions)

LSVPN

Which policies are needed on which devices, varies based on what role the device has for the LSVPN.

It is recommend to define specific policies which cover only the specific addresses of the endpoints, and to have them near the top of the policy list. If the devices are managed by Panorama, it's also recommended to configure these near the top of the "pre rules" security policy configuration.

For the Satellite <-> Portal connection, set the following on both sides:

• Application:
  • ssl, web-browsing, panos-global-protect
• Service:
  • Application-default or tcp/443
• Action setting:
  • Allow
• Profile setting:
  • Profile type: None
• Log setting:
  • Log at session end.

For the Satellite <-> Gateway connection, two separate policies are suggested; on both sides:

First policy is for the ESP (encrypted outer tunnel traffic), since there is no l4-7 inspection needed on this traffic, below settings are optimal : 

• Application:
  • Any
• Service:
  • UDP/4501
• Action setting:
  • Allow
• Profile setting:
  • Profile type: None
• Log setting:
  • Log at session end.

The second policy is for the registration, configuration, and tunnel setup messages between the satellite and gateway. 

• Application:
  • ssl, web-browsing, panos-global-protect
• Service:
  • Application-default or tcp/443
• Action setting:
  • Allow
• Profile setting:
  • Profile type: None
• Log setting:
  • Log at session end.