Which component is used for stateful inspection of TCP, UDP, and ICMP flows in Cisco SD-WAN firewall policies?

Subnets define IP address ranges, which can be part of a zone, but they are not the component that performs stateful inspection itself.

Sites represent physical locations; while firewall policies apply across sites, sites are not the granular component for stateful inspection of individual traffic flows.

Interfaces are endpoints where traffic enters or leaves a device and are assigned to zones, but the stateful inspection logic and policy enforcement are applied at the zone level.

Cisco SD-WAN firewall policies employ security zones to logically group interfaces or subnets, allowing stateful inspection rules to be applied between these zones to control and monitor TCP, UDP, and ICMP traffic flows based on their session state.