Where must application-aware enterprise firewall policies be applied on the same WAN Edge router?

Application-aware enterprise firewall policies are applied within a zone pair on the same WAN Edge router. A zone pair defines the direction of traffic flow between two security zones, allowing specific policies to be enforced when traffic moves from a source zone to a destination zone. This granular control is essential for applying application-aware rules, as the firewall needs to inspect traffic as it transitions between different security contexts. Applying policies "within and between zones" is too broad; policies are specifically tied to the directional flow of a zone pair. Applying policies "between two VPN tunnels" or "between two VRFs" describes different network segmentation concepts, not the direct application point for application-aware firewall policies on a single router.