Do I really need 4 rules here?

hi,

stateful firewall such as the FGT only need to control who is allowed to open a session - this will cover the reply traffic as well.

As you have 2 firewalls now ("servers" and "desktops") you need 2 policies for each intended flow of control, that is, one egress policy on "desktops" and one ingress policy on "servers".

If you additionally want to open connections from a server to a desktop (e.g. for monitoring, or central backup) then you need to add 2 more policies.

If you look at a VDOM as an independent firewall or location, and the inter-VDOM-link as an "WAN" or external interface then it's quite clear how sessions are initiated by whom and how you need policies to allow this.

Or so I hope.