Inbound vs. Outbound

[bfrericks]

On the PIX/ASA, I know that traffic that originates from a higher security interface is considered outbound, but what about the return traffic for that connection. Is the return traffic considered inbound or outbound? Do counters classify the traffic differently than ACL's from that perspective?

[amritpatek]

The trafiic that is from a lower security level to higher security is an inbound traffic even if it is some kind of return traffic. Yes, the counters will be different than the ACL hits because the ACL will be checked only once and the traffic will be allowed or denied based on the rule, however the same will be applcaible for the subsequent traffic so there will be no ACL hit but the counter will be incremented.