diff --git a/telco/referenceImplementation/afoArm.json b/telco/referenceImplementation/afoArm.json
index 33078e22..d7709fed 100644
--- a/telco/referenceImplementation/afoArm.json
+++ b/telco/referenceImplementation/afoArm.json
@@ -1853,6 +1853,9 @@
                     "firewallSku": {
                         "value": "[parameters('firewallSku')]"
                     },
+                    "firewallZones": {
+                        "value": "[parameters('firewallZones')]"
+                    },
                     "addressPrefix": {
                         "value": "[parameters('addressPrefix')]"
                     },
@@ -3903,6 +3906,9 @@
                     "firewallSku": {
                         "value": "[parameters('firewallSku')]"
                     },
+                    "firewallZones": {
+                        "value": "[parameters('firewallZones')]"
+                    },
                     "addressPrefix": {
                         "value": "[parameters('addressPrefix')]"
                     },
diff --git a/telco/referenceImplementation/industrySpecific/subscriptionTemplates/vwan-connectivity.json b/telco/referenceImplementation/industrySpecific/subscriptionTemplates/vwan-connectivity.json
index 09bfc2dc..7567466f 100644
--- a/telco/referenceImplementation/industrySpecific/subscriptionTemplates/vwan-connectivity.json
+++ b/telco/referenceImplementation/industrySpecific/subscriptionTemplates/vwan-connectivity.json
@@ -49,6 +49,10 @@
             ],
             "defaultValue": "Standard"
         },
+        "firewallZones": {
+            "type": "array",
+            "defaultValue": []
+        },
         "enableVpnGw": {
             "type": "string",
             "allowedValues": [
@@ -200,6 +204,7 @@
                                             "type": "Microsoft.Network/azureFirewalls",
                                             "name": "[variables('azfwname')]",
                                             "location": "[parameters('location')]",
+                                            "zones": "[if(not(empty(parameters('firewallZones'))), parameters('firewallZones'), json('null'))]",
                                             "dependsOn": [
                                                 "[concat('Microsoft.Network/virtualHubs/',variables('vhubname'))]"
                                             ],
diff --git a/telco/referenceImplementation/telco-portal.json b/telco/referenceImplementation/telco-portal.json
index 10848355..14bad957 100644
--- a/telco/referenceImplementation/telco-portal.json
+++ b/telco/referenceImplementation/telco-portal.json
@@ -1426,7 +1426,7 @@
                             "multiselect": true,
                             "selectAll": true,
                             "filter": true,
-                            "visible": "[if(equals(steps('esConnectivityGoalState').esHub, 'vhub'), and(equals(steps('esConnectivityGoalState').esAzFw,'Yes'), contains(split('canadacentral,centralus,eastus,eastus2,southcentralus,westus2,francecentral,germanywestcentral,northeurope,westeurope,uksouth,southafricanorth,japaneast,southeastasia,australiaeast', ','), steps('esConnectivityGoalState').esNwLocation)), false)]",
+                            "visible": "[and(equals(steps('esConnectivityGoalState').esAzFw,'Yes'), contains(split('canadacentral,centralus,eastus,eastus2,southcentralus,westus2,francecentral,germanywestcentral,northeurope,westeurope,uksouth,southafricanorth,japaneast,southeastasia,australiaeast', ','), steps('esConnectivityGoalState').esNwLocation))]",
                             "toolTip": "If 'Yes' is selected when also adding a subscription for connectivity, ARM will deploy Azure Firewall to the selected region and availability zones.",
                             "constraints": {
                                 "allowedValues": [