Rule OUT allows everything. Replace it with rules that name applications. App-ID reads a packet to name its application, and service application-default adds a second check: the application must be on its usual port. So web browsing on port 8080 is not the same as web browsing on port 80. On PC1, the command traffic sends one packet with the text you give it.
The simulator ticks each one as soon as the network meets it.
Delete rule OUT. Add rule WEB: from trust to untrust, application web-browsing, service application-default, action allow.
Add rule PING: from trust to untrust, application ping, service application-default, action allow. Commit.
From PC1: traffic tcp 198.51.100.1 80 payload "GET /index.html Host: www.example.org" arrives, and so does ping 198.51.100.1.
traffic tcp 198.51.100.1 22 payload "SSH-2.0-client" is denied, and so is the web request on port 8080: traffic tcp 198.51.100.1 8080 payload "GET /index.html Host: www.example.org". The Traffic Log names interzone-default.
