Hi Michael and thanks for answering.
As nothing has been changed in the router since the old ZD was replaced, the router can not be the problem - also I know that everything is wide open between the two subnets).
The server subnet is wired, so I'm pinging from a wired connection on a different subnet at a different location through VPN. No changes have been made to the VPN connection so that cannot be the problem either.
I haven't configured any whitelists or ACLs in the ZD. That wasn't necessary on the old ZD for PING to Work. Do I need to configure it now running firmware 9.10, or did I perhaps create something on the old ZD that wasn't copied on to the new ZD when the Wireless configuration was imported?