Well, seems that yeah, this router does have 2 layers of firewall built in by default (SPI, DoS), so I guess I'll just ditch ZASS and be done with it.