I've found Cisco docs to be extremely vague and confusing regarding the appropriate way to configure access policies in Cisco IOS-based zone-based firewall (ZBFW).
Say I want to permit ongoing TCP connections from interface A to interface B. These interfaces are allocated each in a different security zone.
I only want to permit TCP sessions that are initiated from interface A over interface B, that is, a A-to-B zone-pair is necessary where it indicates that traffic sourced from zone A to zone B will be permitted/inspected.
So my concern is the return traffic (ie. SYN-ACK packets from zone B). Is this traffic by default permitted conn-table-style? If my access policy (policy-map action) is set to inspect will I be permitting that return traffic? Or will I need a B-to-A zone-pair to allow that traffic?
I'm pretty sure I do not need to create an additional zone-pair solely for the return traffic but I do not have an IOS router available as of now to test this.