When an interface is configured to be a zone member, the hosts connected to the interface are included in the zone. However, traffic flowing to and from the IP addresses of the router’s interfaces is not controlled by the zone policies (with the exception of circumstances described in the note following Figure 10). Instead, all of the IP interfaces on the router are automatically made part of the self zone when ZFW is configured. In order to control IP traffic moving to the router’s interfaces from the various zones on a router, policies must be applied to block or allow/inspect traffic between the zone and the router’s self zone, and vice versa. Although the router offers a default-allow policy between all zones and the self zone, if a policy is configured from any zone to the self zone, and no policy is configured from self to the router’s user-configurable interface-connected zones, all router-originated traffic encounters the connected-zone to self-zone policy on its return the router and is blocked. Thus, router-originated traffic must be inspected to allow its return to the self zone. https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html   HTH Bogdan ... View more