Best Of

Re: IPSec VPN. How to create connection with multiple local and remote networks

Create multiple "Connections" on the same "Gateway".

Re: Negative effect from using "Geo IP" ?

Another question is: someone here see any negative effect from using "Geo IP" to block all Traffic outside of your Region?

It's a huge task create an answer to this question without knowing structure, devices, roles and goals of the network you're talking about.

As in house design, it's like expecting from the designer the house you love to live in without knowing how much is big and what you need and like inside as rooms and services.

mMontana

Re: Connect clients on LAN 1 to server on LAN 2

I'd use only the USG60.

WAN1 and WAN2 on the internet.

Lan1 192.168.147.0/24.

Lan2 192.168.125.0/24.

mMontana

Re: USG 500 FLEX: IPSec Site-to-Site behind Double NAT only possible in Aggressive Mode?

@SAMJUN the "basic" list of accepted Encryption, HMAC, DH and AH is... pretty wide. In my personal opinion, a bit too much.

This will ease a lot the configuration moment with drayek devices, but on the other hand might lead to several negotiation (and security, more on that later) issues: if devices cannot handshake a "common ground" about parameters, the caller could simply said "too many retries" and give up.

This is the cue-in for aggressive mode, which more or less skip handshaking and accepts pretty much anything is proposed. If the IPsec communication is narrowed to the only/few static addresses expected to call, that's fine and no concern at all. If it's expected to receive contact from the whole internet because of roaming clients, I personally won't allow aggressive negotiation.

Security point has been already introduced talking about aggressive mode, but now comes to the encryption. In 2022, DES and 3DES are secure as much as PPTP, so no security at all. DES was retired in 2005, 3DES in 2018, AES was introduced in 2001.

Allowing any DES version (DES, 3DES, TwoWay DES) is no security thinking for todan nor for tomorrow, as my personal opinion and practice. This doesn't mean that any IPSec VPN DES based won't work, it's simply not a wise choice for me.

I suggest you to take a bit more tinkering narrowing the options and preferring securer ones. If the Draytek will allow you only to chose among three presets, pick medium or high, note down encryption, HMAC, DH possible and put the simplest among these one into your USG500.

mMontana

Re: How to setup an IKEv2 VPN connection on Nebula which is compatible with Android 12 ?

Zyxel_Cooldia said:

We will release Android App for this issue.

May I advise Zyxel against this? Apps might be sellable like licenses and and subscriptions, but when the app will have issues with some Android flavours (RealOS, MiUI) or hit fragmentation, well... might be a tough path.

IKEv2 + PSK is already supported for IPSec connections...

mMontana

Re: UAG 5100 how to optimize the two Wan available?

Backup your lastgood.conf and startup-config.conf files before start to edit anything.
Go into trunk section of interfaces (Screenshot coming from USG60, Firmware 4.71 but concepts should be similar.
In this image you should find something similar to your UAG 5100. The device is using default trunk or one of the user configurations.
You can create a "newer" user configuration an pick the preferred one.
Whick one, among wrr or llf? Pick your UAG 5100 manual, section 11. Should explain to you what to prefer, and why.
When created, you can pick it clicking on the dropdown.
Under User Configuration you will find the system_default_wan_trunk. I strongly suggest you, if present or selected, to not edit it. It will be a easier fallback.

Consider that you either setting, is quite unlikely to reach 35MB into a single connection (device might happen, but still unlikely. I'm not aware of any service that can serve via multipoint connection the same client.

Anyway, some of the traffic could be routed to WAN2, but unless tweaking manually the source routing, you'll have no control of which connection will be used for one host and when it will be switched to the other one. You can pick the algorithm and the weight, then let the device "do its thing", even if you don't understand why and how it picked one or the other route.

WANs configuration about connectivity check and Ingress/Egress will play a consistent part of interface behavior. Also Bandwidth Management (BWM).

If the current configuration satisfy well enough needs, keep it available when you'll need it. As a rule of thumb... change something. Take notes. Let it fail, analyze stats, rethink. Change again. Take notes. Let it fail (hopeful less).

Take time to understand how the thing work before doing config stunts.

mMontana

Re: Attempt to login to USG50, Chrome reports ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Lyonsvt said:

I would like to confirm that the USG50 can also be configured (using CLI or web interface) to increase its minimum security level so that current Google Chrome is satisfied.

I cannot confirm. Depends not only from the "current" Google Chrome request, but also on the firmware version. Anyway, this is a way for disabling insecure cypher. https://kb.zyxel.com/KB/searchArticle!gwsViewDetail.action?articleOid=014475&lang=EN

Lyonsvt said:

Additionally, would this change impact any existing security definitions for VPNs?

AFAIK it depends from the configuration of the VPN tunnels.

USG50 has been updated last time during 2016 https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=MD09108&md=ZyWALL USG 50 The most updated firmware is a "weekly firmware", but currently i don't have any URL for that. Changing the device is strongly suggested, current "replacement" for USG50 is USG200 Flex (two proper WAN ports). USG 50 Flex could be also used due to a dual personality port (OPT/WAN2)

mMontana

Re: Bandwidth limitation on WAN ports?

The USG40W is a bit of a light wight it may be listed as 400Mb but that is for UDP TCP is around 200Mb is what your seeing.

You may make it faster by going to monitor > system status > traffic statistics and uncheck Collect Statistics then apply.

You can also go to configuration > system > advanced and check enable but that disables some stuff you might need.

PeterUK

Re: IPsec VPN connection, Windows RDP keep dropping

For anyone having this problem its to do with being behind NAT and on the nailed up side a workaround that seems to work on the nailed up side is to make a firewall rule from WAN/OPT to zywall service NATT UDP 4500.

PeterUK

[QUIZ] Be a WiFi 6 expert! What advantages can you get from WiFi 6?

If you’re suffering from buffering, you might need to consider getting on the super-fast highway with the fastest WiFi 6 (802.11ax) technology. Designed to increase network capacity and improve the performance of your home network, WiFi 6 is the latest generation of WiFi technology. Wanna know what WiFi 6 improves compared with WiFi 5?

Visit Multy – WiFi 6 Whole Home Coverage WiFi System

Which of the following is NOT an advantage you can get from WiFi 6?

Zyxel_Carter