I have 2 gateways on my ZS, so QoS is not working due to a known bug. However I classify vpn traffic at the Netbalancer so that all traffic goes out the gateway I want.
pkts bytes target prot opt in out source destination
122M 14G MARK tcp -- !BRIDGE00 any anywhere anywhere tcp spt:1194 MARK set 0x66
BRIDGE00 is my internal network.