Hi Jonas,
Thanks for your response. There is no permit tunnel from Internet zone to Camera Zone, I didn't realise this would be needed for each zone the dyn-vpn client accesses, so looks like I'll need to add that for Camera zone and VPN zone (ipsec vpn). I'll try this later today and post results.