In my deployment I have a production VPN (VPN1) and a guest VPN (VPN2). I want to allow my guest network to talk to specific devices on my production network for the purposes of wireless screen casting. My preference is to keep the traffic local in each branch office (not route across the WAN and hairpin back).
When I read the zone based firewall documentation I get the understanding that "zones" are tied to VPNs. But I also understand that by default VPNs are designed to not communicate with one another, similar to VRF. I feel like I am missing something on how this is meant to allow/deny traffic between VPNs/Zones without something else needing configured for the routing component.
