-
"Untrusted" on USG FLEX 100 After Rekey GoDaddy Certificate
Scenario Rekeyed (renewed) the GoDaddy SSL certificate on the USG FLEX 100. The new certificate only carries the "Server Authentication" EKU — "Client Authentication" is gone — and the issuer changed from "Go Daddy Secure Certificate Authority G2" to "GoDaddy TLS Intermediate CA DV R1v1". After installing it, the browser…
-
USG FLEX in Cloud Monitoring Mode but shows no monitoring pages in Nebula
Question I added my USG FLEX firewall to Nebula in Cloud Monitoring Mode. The device appears in the site, but it does not have monitoring pages like access points and switches. Is something wrong? Answer No, this is expected behavior. When a USG FLEX firewall is added to Nebula in Cloud Monitoring Mode, only a limited set…
-
[USG FLEX H] How to setup Captive Portal for redirect wireless clients connecting to managed APs?
Scenario When using a USG FLEX H Series firewall to manage wireless APs, you can configure a captive portal for wireless clients through the firewall's built-in Web Authentication feature. Unlike an AP-based captive portal, this method uses the firewall to redirect wireless clients to an authentication page before granting…
-
How can I check whether an AP can be managed by a USG FLEX H firewall?
You can refer to the USG FLEX H firewall' local GUI, and navigate to Wireless > Access Points > AP Firmware
-
How can I check whether an AP can be managed by a USG FLEX H firewall?
You can refer to the USG FLEX H firewall's release notes and check the "AP Controller Supported Managed AP List" section. You can download the release notes here: Download Library | Zyxel Networks
-
[USG FLEX H] PoE Budget Specifications and Over-Budget Behavior
Q1: What is the maximum PoE power budget for the USG FLEX H series PoE models? Is it dedicated per port or shared across ports? Answer: The USG FLEX H series provides a total PoE power output of 30W. For models with only one PoE port (such as the USG FLEX 50HP, 100HP, and 200HP), the single port provides a dedicated power…
-
[SecuReporter] "The agent cannot be a member" error when adding an email address
Q: I'm trying to add an email address as a member in SecuReporter, but I get the error "The agent can not be a member." What does this mean? A: If you are trying to add an account that already has access to SecuReporter (i.e., the owner account), this error will appear. Since this email address already has access to its…
-
Where can I report false positive for content filter/reputation filter?
Please visit the below website to submit false positive report: http://sitereview2.cloud.zyxel.com/
-
[SecuReporter] How to Remove/Delete the Device from SecuReporter
To completely remove the device from your SecuReporter organization list: Please navigate to the top menu > more > Organization & Device > Organization. Click the ">" button on your organization. Mouse mover to the device and the delete option will be displayed.
-
[SecuReporter] How to Delete or Disable Scheduled Reports
To stop the email reports from being sent, you need to remove the report schedule in the SecuReporter portal: Log in to the SecuReporter Portal. Navigate to Menu > History > Report > Report Settings. Disable the schedule report settings by click the settings button on each report setting(Daily/Weekly/Monthly).
-
[ATP/FLEX] Why can't the captive portal page pop up automatically on the LAN client?
Question : Why can't the captive portal page pop up automatically on the client? Answer : Normally, this issue occurs because the HTTP requests sent by the client during the connectivity check process are not handled properly after the client obtains a DHCP-assigned IP address, resulting in the server responding with an…
-
[ATP/FLEX] Policy route for SNAT
If your ISP suggest to setup SNAT for outgoing IP, you may follow this FAQ to setup the policy route rule with SNAT to achieve this requirement. Setup steps: Navigate to Configuration > Network > Routing > Policy route to add a new policy route rule. Click the add button and you may setup the policy route rule. Below…
-
[ATP/FLEX] Firewall High Availability HA Pro - Configure Device HA Pro
Device HA Pro is a service that is used to provide network redundancy to reduce potential downtime and does not require any additional licenses to activate this service. In addition, Device HA Pro synchronizes the configuration file, device uptime, TCP sessions (IPv4/IPv6), IPSec VPN sessions, I/O information, DHCP table,…
-
Why is the "Schedule Reboot" option greyed out or unavailable in my settings?
Question: Why is the "Schedule Reboot" option greyed out or unavailable in my settings? Answer: The Schedule Reboot and Auto Firmware Upgrade features are mutually exclusive. If you have Auto Update enabled under Firmware Management, the schedule reboot option will be locked. You must disable the automatic firmware updates…
-
What happens if the passive device fails to reboot during a scheduled reboot window?
Question: What happens if the passive device fails to reboot during a scheduled reboot window? Answer: If the passive device fails to complete its reboot successfully, the active device will abort the entire process to prevent a network outage. It will reject the scheduled reboot and generate the following system log…
-
Where do I go in the web interface to configure a scheduled reboot?
Question: Where do I go in the web interface to configure a scheduled reboot? Answer: You can configure this setting by navigating to MAINTENANCE > Shutdown/Reboot in the device GUI. From there, check the Schedule Reboot option and specify your preferred frequency (Daily, Weekly, or Monthly) and time.
-
How does the schedule reboot process work when firewalls are configured in Device HA mode?
Question: How does the scheduled reboot process work when firewalls are configured in Device HA mode? Answer: To prevent network downtime, the scheduled reboot is executed sequentially rather than simultaneously: The active device initiates the process by sending a reboot request to the passive device. The passive device…
-
Why is the service status of my HA devices not updating after assigning a license?
Question: Why is the service status of my HA devices not updating after assigning a license? Answer: Make sure the correct serial number associated with your licensed device is configured in the Device HA Pro settings. Navigate to Device HA Pro page in your device's web interface. Enter the correct serial number of the…
-
Why can't newly created admin users log in?
Question: The default admin account works fine on the firewall, but newly created admin accounts were unable to log in and returned "incorrect credentials" errors. Attempting password resets and recreating users didn’t solve the issue. Answer: The problem occurred because the authentication method for non-default admin…
-
Why did WLAN stop working after upgrading to firmware version 5.41 on USG FLEX 100W and ATP100W?
Question: After upgrading to firmware version 5.41, WLAN clients in the guest network were unable to obtain an IP address, even after resetting the configuration and reconfiguring the SSIDs. Answer: The issue was identified as a bug in firmware 5.41. The bug will be fixed in the next official release 5.42. Before 5.42 is…