-
How can I perform a traceroute check via the CLI on a USG FLEX H model?
Question: How can I perform a traceroute check via the CLI on a USG FLEX H model? Answer: The user can use the following CLI command to perform a traceroute check: cmd traceroute <domain name or IP address> The user can also specify the source interface by using the following CLI command: cmd traceroute <domain name or IP…
-
How can I perform a traceroute check via the Web-GUI on a USG FLEX H model?
Question: How can I perform a traceroute check via the Web GUI on a USG FLEX H model? Answer : The user can navigate to Maintenance > Diagnostics > Network Tool, select “TRACEROUTE IPv4” enter the destination domain name or IP address, select the appropriate interface, and then click “Test” to perform the traceroute check.
-
How can the user check the current DHCP status via the CLI on a USG FLEX H model?
Question: How can the user check the current DHCP status via the CLI on a USG FLEX H model? Answer: The user can use the CLI command show state vrf main dhcp to display the current DHCP-related settings (for example, the lease time, subnet, DHCP IP address range, reserved DHCP IP addresses, etc.), as shown below:
-
How to capture DHCP Packets via the CLI on the USG FLEX H?
Question : How to Capture DHCP Packets via the CLI on the USG FLEX H ? Answer : The user can filter UDP port 67 or UDP port 68 to capture DHCP packets via the CLI. For example, the user can select the ge3 interface and filter DHCP packets using the following CLI command: cmd traffic-capture ge3 filter 'udp port 67 or udp…
-
How to configure WAN Spillover configuration on H Firewall ?
Question: How to configure WAN Spillover configuration on H Firewall ? Answer: To configure an active-passive WAN Spillover with a primary (WAN1) and backup (WAN2) link, you need to use the WAN Trunk settings on your device's local Web GUI. Go to local Web GUI > Network > Interface > Trunk. Create a User-Defined Trunk.…
-
What is the interval of each connectivity check?
Question: What is the interval of each connectivity check? Answer: It depends on the connectivity-check configuration For example: Check Period: 30 seconds Check Timeout: 5 seconds Check Fail Tolerance: 5 times. So totally it takes 35*5=165 seconds to determine a connectivity-check failure.
-
How do I disable SIP ALG on a USG FLEX H Series ?
Question: How do I disable SIP ALG on a USG FLEX H Series device? Answer: On the USG FLEX H Series, SIP ALG is presented as SIP Pinhole in the firewall settings. By default, SIP ALG is disabled. Log in to the Web Configurator and go to Configuration > Network > ALG. Then clear Enable SIP Pinhole and click Apply to save the…
-
Why can't the same subnet be used on WAN and LAN on USG FLEX H?
Question: Why can't the same subnet be used on WAN and LAN on USG FLEX H? Answer: In the case of USG FLEX H device, it does not allow configuring a LAN and WAN interface within the same subnet. Attempting this on other devices, such as ATP or USG FLEX, may lead to problems, known as ARP flux. ARP flux occurs when a device…
-
How do I configure routing on USG FLEX H?
Question: How do I configure routing on USG FLEX H? Answer: In the firewall local WebGUI, go to Configuration > Network > Routing, where you can add either a Policy Route or a Static Route. After configuration, go to Monitor > Diagnostics > Packet Flow Explore to check the overall routing status.
-
How can I troubleshoot the network environment if it cannot reach 8.8.8.8?
Question: How can I troubleshoot the network environment if it cannot reach 8.8.8.8? Answer: In the Firewall local WebGUI, go to Monitor > Diagnostics > Network Tool > Tracert Router IPv4, then test the route to 8.8.8.8 to identify where traffic is blocked. If the Firewall can reach 8.8.8.8 but the PC cannot, please…
-
Can I create a static DHCP table with the same MAC address?
Question: Can I create a static DHCP table with the same MAC address? Answer: You cannot create multiple static DHCP entries with the same MAC address. The GUI has validation protection and will block duplicate MAC address entries.
-
How do I remove the SNAT address under Policy Route on an H Series Firewall?
Question: How do I remove the SNAT address under Policy Route on an H Series Firewall? Answer: In the firewall local WebGUI, go to Configuration > Network > Routing > Policy Route, edit the target rule, and remove the SNAT address. Then select Source IP so outgoing traffic uses its own IP address to NextHop Interface.
-
How can I use two WAN connections on H Series?
Question: How can I use two WAN connections on H Series? Answer: In the Firewall local WebGUI, go to Network > Interface to configure WAN1 and WAN2, then go to Network > Interface > Trunk to define Load Balancing or Failover behavior.
-
What should I check if DHCP and internet are not working on a Zyxel firewall?
Question: What should I check if DHCP and internet are not working on a Zyxel firewall? Answer: Check in this order: Confirm WAN link is up and has a valid IP/gateway/DNS from ISP. Verify LAN interface DHCP server is enabled with correct subnet, pool range, and gateway option. Ensure clients receive valid IP, gateway, and…
-
How do I check whether different VLANs belong to zones?
Question: How do I check whether different VLANs belong to zones? Answer: Go to Object > Zone to review zone configuration, then check each VLAN interface mapping to confirm which zone it belongs to. If the VLAN is correctly assigned, it will appear under the corresponding zone (for example, LAN/DMZ/WAN/custom zone).
-
Can WRR be configured by bandwidth or by metric?
Question: Can WRR be configured by bandwidth or by metric? Answer: WRR is configured based on weight, not routing metric. It distributes sessions by assigned WAN weight, where higher-weight links carry more traffic.
-
How do I configure "Disable policy route automatically while Interface link down" function?
Question : How do I configure "Disable policy route automatically while Interface link down" function? Answer : The user can navigate through the GUI path: Network > Routing > Policy Route. To enable the “Disable policy route automatically when interface link is down” function, go to Advanced Settings, as shown below: Once…
-
Where can I check whether any rule is blocking ICMP packets?
Question: Where can I check whether any rule is blocking ICMP packets? Answer: 1)Log in your Firewall by Web GUI 2)Navigate to "Security Policy" > "User/Group" > "Policy Control", Click the “Filter” icon and set the criteria to “Service = ICMP.” You can check which rule is blocking ICMP.
-
How can I confirm whether my port is actually running at 1 Gbps speed?
Question: How can I confirm whether my port is actually running at 1 Gbps speed? Answer: 1)Log in Firewall by Web GUI. 2)On the dashboard, you can see the connected port speed. For example: The Port 1 have 1Gbps speed now.
-
Why is the WAN source IP not showing on internal servers of a NAT rule?
Question: A customer using NAT rules observed that incoming traffic to their internal servers doesn't display the original WAN client source IPs. Instead, it shows the local interface private IPs. Answer: It may be affected by a policy route rule. This rule was set as 'incoming any, source any, destination any,' which led…