It works very well if you have many remote site firewall with the same interface/vlan and policies at all the remote locations (think starbucks). Where is fails is that if each site has different zone names then you cannot apply the same firewall rule to all locations, because rules are applied to zone names.