Could you explain in detail how the network topology has been developed ?
Eg, are both ZS the default gateways for the clients of the HQ and branch networks ?
Or there are other routers which perform this job, with some port-forwarding to the ZS machines and the ZS is a “simply” client of the existing networks ?
Regards