Technical Tip: Traffic is hitting the implicit deny policy, when interface is used instead of zone to allow the traffic

When examining policy and zone:

config system zone
    edit "IPSEC-1_zone"
        set interface "IPSEC-1"

config firewall policy

    edit 434
        set status enable
        set name "IPSec-to-LAN"
        set srcintf "IPSEC-1" <------ Note that as interface 'IPSEC-1' is used instead of 'IPSEC-1_zone', policy ID 434 will not be matched. Instead, traffic will hit the implicit deny policy upon running debug flow.
        set dstintf Lan
        set action accept
        set srcaddr All
        set dstaddr ALL
        set schedule "always"
        set service "ALL"
        set logtraffic all

If an interface belongs to a zone, the zone must be used in the firewall policy, not the individual interface.

config system zone

    edit "vpn_IPSEC-1_zone"
        set interface "IPSEC-1"

            config firewall policy
                edit 434
                    set status enable
                    set name "IPSec-to-LAN"
                    set srcintf "IPSEC-1_zone" <------- Change interface 'IPSEC-1' to 'IPSEC-1_zone'. Upon running the debug flow, policy ID 434 will be matched. Traffic will not hit the implicit deny.
                    set dstintf Lan
                    set action accept
                    set srcaddr All
                    set dstaddr ALL
                    set schedule "always"
                    set service "ALL"
                    set logtraffic all

Verify that traffic is being allowed by firewall policy ID 434 via the forward traffic log in the GUI.