Are you able to post a copy of your ZS profile to the forum for us to inspect? I’d like to try to reproduce this problem. This seems like such a simple routing problem yet you’re running into ARP errors you shouldn’t.
If you don’t want your admin password exposed, you could change it to the ZS default before backing it up, then change it back. I’d also suggest backing it up without logs; that will make the profile backup smaller.
What kind of switch are you using? I have access to Cisco Catalyst and HP Procurve switches to test against, both of which are L3 capable.