-
Why can't I resolve my Nebula assigned domain name?
Question: Why can't I resolve my Nebula assigned domain name? Answer: To ensure proper resolution of the Nebula assigned domain name, the following conditions must be met: Either IPsec VPN or SSL VPN must be enabled. The "Type" setting for your VPN server must be configured to "Nebula Assign Domain Name". A common cause…
-
How to configure Split Tunnel SSL VPN for specific website access on USG FLEX H?
Question: How can I configure the USG FLEX H to route traffic for a specific website through the SSL VPN tunnel using the wan IP of the USG FLEX H, while allowing all other internet traffic to bypass the VPN and use my home's external IP? Answer: To achieve specific website routing through your SSL VPN tunnel on a USG FLEX…
-
Does USG FLEX H support AES256-CBC encryption for IPsec VPN Phase 1 and Phase 2?
Question: Does USG FLEX H support AES256-CBC encryption for IPsec VPN Phase 1 and Phase 2? How do I configure AES256-CBC on USG FLEX H for an IPsec VPN connection? Answer: Yes, USG FLEX H series supports AES-256-CBC encryption. For IPsec VPN, the Standard AES-CBC algorithms (including AES-128-CBC, AES-192-CBC, and…
-
What event logs are generated when the VPN client obtains the VPN provisioning file?
Question : What event logs are generated when the VPN client obtains the VPN provisioning file? Answer : The user can refer to How to get the VPN script file from the USG Flex H firewall? to know how to get the VPN script file from the firewall. Navigate to Log & Report > Log / Events > System. The event logs show that the…
-
How to get the VPN script file from the USG Flex H firewall?
Question : How to get the VPN script file from the USG Flex H firewall? Answer : Navigate to VPN > IPsec VPN > Remote Access VPN, and enable it. Open the SecuExtender VPN client from the PC. Enter the VPN server's IP address, along with the authorized VPN username and password and click 'Next'. VPN script file retrieved…
-
[USG FLEX H series] How can I set NAT traversal for remote access VPN on Nebula?
Q: How can I set NAT traversal for remote access VPN on Nebula? A: If your "VPN server address Type" is "Nebula assigned domain name", you don't need to set NAT traversal setting. Nebula will help to set it if your USG FLEX H is behind NAT/router. Additionally, the NAT traversal option will only appear if "VPN server…
-
Why 2FA auth page not automatically appear when using OpenVPN Connect?
Question: Why 2FA auth page not automatically appear when using OpenVPN Connect? Answer: The automatic display of the 2FA authentication page after a VPN connection is a feature specifically integrated into the Zyxel VPN Client (SecuExtender). Third-party VPN clients, such as OpenVPN Connect, do not have this built-in…
-
What does the log "Delete duplicated CHILD_SA: for the VPN connection" mean?
Question: What does the log "Delete duplicated CHILD_SA: for the VPN connection" mean? Answer: The log entry “Delete duplicated CHILD_SA” does not indicate an error or malfunction on VPN connection. It's more like to be a IPSec VPN operation log. When the firewall detects that multiple CHILD_SAs are created for the same…
-
How to adjust MSS value for VPN tunnel on Zyxel USG FLEX H series devices?
Question: How to adjust MSS value for VPN tunnel on Zyxel USG FLEX H series devices? Answer: For Policy-based VPN tunnels, direct adjustment of the MSS parameter is not supported. For Route-based VPN tunnels (utilizing VTI interfaces), you can adjust the MTU value through the Web GUI instead of MSS. (Navigate to Network >…
-
Why MFA page does not pop out when using Windows built-in VPN?
Question: Why MFA page does not pop out when using Windows built-in VPN? Answer: Windows native Client won't automatically pops out the 2FA auth page, you have to manually access the 2FA page by the interface IP and port you configured. Windows native VPN does not support this feature. Our VPN client (Zyxel IPSec VPN…
-
How to check debug log for VPN?
Question: How to check debug log for VPN? Answer: Please input CLI to enable debug level log for VPN. usgflex200h> cmd diagnostics ike enabled true ike-diagnostics-set-active data result ok .. .. usgflex200h> cmd debug ipsec trace log Jun 22 15:33:29 05[CFG] loaded 0 entries for attr plugin configuration Jun 22 15:33:29…
-
Does Auto-link VPN supports failover?
Question: Does Auto-link VPN supports failover? Answer: No. Auto-Link VPN does not support failover. It's Nebula SD-VPN supports VPN failover
-
How to Create an SSL VPN with OpenVPN on Nebula?
Question: How to Create an SSL VPN with OpenVPN on Zyxel Nebula Answer: To configure an SSL VPN with OpenVPN on Nebula, follow these steps: On Nebula, navigate to Site-wide > Configure > Firewall > Remote access VPN. Enable SSL VPN Server and configure Type, Interface and Sign-on with method. After the configuratio file is…
-
How to Resolve SSL VPN Connection Issues on USG FLEX H firewall?
Question: How to resolve SSL VPN cnnection issues on USG FLEX H firewall? Answer: If you are facing SSL VPN connection issues, such as constant disconnects and reconnects, follow these steps to resolve the problem: Check Two-Factor Authentication (2FA): If 2FA is enabled under “User & Authentication > User Authentication >…
-
Why is the VPN tunnel connected, but only TCP traffic can be transmitted?
Question: Why is the VPN tunnel connected, but only TCP traffic can be transmitted? Answer: Please check whether the protocol in Phase 2 is set to "Any." If a specific protocol, such as TCP, is selected, then other protocols will not pass through the tunnel.
-
How to Set MSS Clamping for VPN on USG FLEX H Series?
Question: How to Set MSS Clamping for VPN Interface on USG FLEX H Series? Answer: The MSS (Maximum Segment Size) clamping setting for VPN interface is not directly configurable via the GUI on the USG FLEX H series. However, this can be performed using CLI commands. Steps to set MSS Clamping via CLI: Access the device's…
-
What is the capacity for SSL VPN Access Profiles?
Question: What is the maximum number of SSL VPN client profile and profile user list? Answer:
-
How to Configure SSL VPN Access Profile
With multiple SSL VPN client profiles, you can create one or more profiles to apply its own settings such as IP pool, DNS and tunnel type to specific users. This example illustrates how to create multiple SSL VPN client profiles for different groups. Note: This feature is supported from firmware version uOS 1.38. Add…
-
Why can't I connect to IPSec VPN with SecuExtender?
Question: Why can't I connect to IPSec VPN with SecuExtender? Answer: If you are facing issues while establishing an IPSec VPN connection via SecuExtender, it could be related to the authentication settings in your VPN configuration. Here's how to resolve it: Log in to USG FLEX H's web interface. Navigate to the VPN >…
-
How to Troubleshoot SSL VPN on USG FLEX H firewall?
Question: Why does the SSL VPN fail to connect? How to troubleshoot SSL VPN on USG FLEX H firewall? Answer: If you're encountering issues with SSL VPN configuration on your USG FLEX H firewall, follow these troubleshooting steps: Steps to Resolve SSL VPN Connection Issues: Ensure you have created a username under SSL VPN >…