Step 2. Establish policies between zones - For each pair of "source-destination" zones (for example, from the inside network to the outside internet), define the sessions that clients in the source zones can request from servers in destination zones. These sessions are most often TCP and UDP sessions, but may also be ICMP sessions, such as ICMP echo. For traffic that is not based on the concept of sessions, the administrator must define unidirectional traffic flows from source to destination and vice versa. Policies are unidirectional and are defined based on source and destination zones, which are known as zone pairs.