ZyXEL Communications ZyWALL Series Support Note page 43

Step 5. Disable "Use Policy Route to control dynamic IPSec rules" on HQ device.
Configuration > VPN > IPSec VPN > VPN Connection > Global Setting
HQ Routing Packet Flow
Maintenance > Packet Flow Explore > Routing Status
Verification