07-22-2021 10:45 AM
1) it simplifies intervsys routing but you still need "external" zone security rules
2) you assign it to all vsys by _not_ assigning it to a vsys
3) if you don't add the visibility you simply created a bad configuration by setting the next hop to a not-visible vsys