Had to create a LAN to LAN any any rule for RED60 deployment, is this safe?

Question

Hi, recently we deployed a RED60 at a satellite office. Internet is working great, email and server access is fine. We found out though that when I try to ping devices on the RED network, it does not work. VoIP also doesnt seem to work when its internal. 
 I did a policy test and found the packets are dropped due to no rule. I create a LAN to LAN rule set for any service any port etc. and that seemed to fix the issue. 
 I found this article on setting up RED devices and they even say you may need to create a LAN to LAN rule to get traffic working: https://support.sophos.com/support/s/article/KB-000036362?language=en_US 
 "For traffic to pass between the two firewalls, a LAN to LAN or similar rule must be created on each firewall." 
 
 Now my question to this community is, is this safe or even best practice? I am hesitant because of the "any to any" stuff. Since the RED device is considered LAN zone, I must create this rule because otherwise the sophos doesnt know to route my traffic to that network. Ive done some research and asked around and some techs are saying its not secure. 
 Is there a better way to do this? Should I instead be creating some type of static route or perhaps in my rule for the destination instead of LAN should I specify just the RED devices subnet? Most of our VLANs are handled by our switches so normally internal LAN traffic never hits the firewall other than this scenario but I'm worried im creating a big security hole. Does anyone have any insight or information that could help calm my fears? Thank you!

Prism · Accepted Answer

Now my question to this community is, is this safe or even best practice? I am hesitant because of the "any to any" stuff. Since the RED device is considered LAN zone, I must create this rule because otherwise the sophos doesnt know to route my traffic to that network. Ive done some research and asked around and some techs are saying its not secure. 
 Any rule that is Any to Any isn't safe by default. By creating a LAN Rule with Any Sources and Destinations, means that any traffic from that zone will now be open to talk with themselves. 
 First i can recommend you to create a separate Zone for the RED's, instead of using the LAN Zone. (This will be better for management later.) 
 
 If you can't change Zones for the RED anymore, then It's better to create a better rule, with the correct Source Networks and Destinations Networks. 
 Close down your rule as much as you can, if a network or device don't need certain access, then don't allow it. 
 You can do this by creating the correct networks and applying it on the rule. Here's an example: 
 
 In this Rule the WiFi Network is allowed to talk with anyone at the Servers Network, but also need to be authenticated with XG, through AD or captive portal. 
 
 Thanks!