How is a Security Policy enforced on a hosts different interfaces?
A Security Policy is enforced on all the interfaces of a FireWalled host or gateway. The only way to restrict the enforcement of a rule to specific interface is by using INSPECT. On each interface, the Security Policy is enforced differently for incoming and outgoing packets, depending on the rule’s Install On field.