Newly created second "separate zone" wireless network is unable to pass traffic and firewall log indicates Country Blocking

Issue:                    Created a 2nd “separate zone” wireless network, but unable to browse internet and firewall repeatedly reports “country blocked” regardless of website being accessed.

I can successfully see new wireless network from devices/laptops, and can successfully connect to the wireless network if the device/laptop is in whitelist. Where the failure seems to be is between the device/laptop and the New Wireless Network’s gateway. I am unable to ping the IP of the gateway. The firewall logs show the devices/laptops being “Country Blocked”, UDP and TCP, for any internet address including the gateway itself. If I disable “Country Blocking”, then I am able to browse the internet from the new wireless network but still unable to ping gateway. Same websites are accessible (no Country Blocking issue) from LAN and other two existing wireless networks, and all can ping respective gateways.

I am sure I have something misconfigured, but cannot locate the problem.

More details below:

UTM Model:                      SG230

Wireless Appliance:        AP30

Firmware version:           9.409-9

There are 2 existing wireless networks (“employee” bridged to AP LAN, and “guest” separate zone) that are working flawlessly. I needed a second “guest” wireless network. I performed the following:

1. Created new wireless network (mostly mimicking settings of current guest WiFi), making sure to select Separate Zone, client isolation enabled, and MAC filtering “Whitelist” enabled.
2. Created appropriate MAC Address Definition group for whitelist.
3. New “wlan2” interface was created. Made sure IP, netmask etc., was correct.
4. Created new DHCP pool (making sure IPs were correct, and have DNS1 and GW pointing to same subnet x.x.x .1).
5. Added firewall rule and turned on:
   1. Source:                 New Wireless Network (network)
   2. Services:              Web Surfing
   3. Destinations:     Any
   4. Allow
   5. Log traffic enabled
6. Created NAT Masquerading Rule:
   1. Network:             New Wireless Network (network)
   2. Interface:            External (WAN)
   3. Use address:      <<Primary address>>
7. Added New Wireless Network (network) to DNS Global tab > Allowed Networks.