In a route-based site-to-site VPN, an outbound firewall security policy permits traffic from the local internal zone to the VPN tunnel zone, with the local subnet as the source address and the remote subnet as the destination address. To allow hosts at the remote site to initiate traffic to the local internal network, how must the zones and subnets be configured in the inbound security policy rule?

### What a good answer covers - One rule permits traffic from Internal to VPN_TUNNEL_01. - The other rule permits traffic from VPN_TUNNEL_01 to Internal. - Source and destination subnets reverse between the directions. - Both rules use application any, application-default service, and Allow action. ### The concept A security policy controls whether traffic is permitted between zones. The lab places the local internal network in the Internal zone and VPN traffic in VPN_TUNNEL_01. A rule's source and destination addresses must reflect the direction being permitted. The reverse rule is not a duplicate with the same addresses; the source and destination networks exchange roles. ### Terms - **VPN**: Virtual Private Network. A protected connection between networks. - **LAN**: Local Area Network. A site's internal network. ### Remember For the reverse policy, reverse the zones and the subnet addresses too.