Traffic originating in local zone is blocked by default action

[tjh]

I’m not sure that Zone Based Firewalls currently work with VRFs.

Edit: This comment can be ignored, see further down.