-
What do 3 temperature sensors stand for?
Question: When using the follwowing commands to show the device's temperature, there are Sensor[0], Sensor[1] and Sensor[2]. What do 3 temperature sensors stand for? Router> debug hardware Router(debug hardware)# fan-get Answer: The 3 temperature sensors are CPU, HW monitor, switch. Sensor[0]: CPU Sensor[1]: HW monitor…
-
How to search our FAQ by Google Engine
You're used to search Technical/License documents by google engine. This article will teach you how to quickly use the google engine to find our FAQs. For example: 1)Find keyword:VPN in site: community.zyxel.com , and we also recommend that seach time for 2022~2023 year to avoid expired inforamtion 2)You will have the…
-
What should we check if the synchronization of the standby device fails?
Question: What should we check if the synchronization of the standby device fails? Answer: We can access standby device terminal, and by typing CLI Router# show device-ha2 trace-log, With the result, we can determine in which phase the standby device's synchronization failed."
-
What debug information should I collect when CPU usage is high?
Question: What debug information should I collect when CPU usage is high? Answer: Use the commands to collect the detailed information of CPU usage. Router> debug system show cpu all Router> show cpu average Router> debug system ps Router> debug system top iterations 3 Connect the console cable between the device and a…
-
How to perform HA synchronization manually by CLI?
Question: How can I manually perform HA synchronization by CLI? Answer: We can run the CLI Router# device-ha2 sync_to_passive in active device, or run the CLI Router# device-ha2 sync_from_active in standby device to perform HA synchronization manually.
-
Verify UserAgent and URL when connected to WebGUI
We have new mechanics in 5.37 that verify UserAgent/URL when client connected to Firewall WebGUI, If not in the list will be forbidden To show current config: Router(config)# show ip http web-auth To modify config: Router(config)# ip http web-auth Router(ip-http-web-auth-options)# pattern-uri <pattern>…
-
Captive Portal does not work on iOS device
Symptom iOS device will not redirect URL to authentication page due to some reason Workaround: 1)Browse http://captive.apple.com manually, It will redirect to authentication page.
-
How to remove the use of RC4 and DES ciphers?
Question: How to remove the use of RC4 and DES ciphers? Answer: Use the following commands to remove RC4 and DES Router# Router# configure terminal Router(config)# show ip http server secure status active : yes port: 443 certificate: default force redirect: yes authentication client: no strong cipher suite: yes customized…
-
Is there any way to remove saved IP from SecuExtender History?
Question Every time when we connect to a new device via SecuExtender. It will save IP to server list. The server IP list becomes longer. Is there any way to remove saved IP from SecuExtender History? Answer Yes, the IP information is save to an xml file which is located at windows user's folder, just edit this file to…
-
If you are experiencing issues with AD authentication
Issue: If you have authentication issue with AD after enabled MSChapv2. Checking: 1)Please capture packets when client tried to authenticate. You will find AD reject Samba request. Root cause: 1)Due to Legacy USG only supporting SMBV1, if your AD server has disabled SMBv1 for security concern, it will result in a failure.
-
What licenses will be consumed if you have Bundle license and Gold Security Pack at the same time
Scenario 1 Activating the Gold Security Pack to a USG FLEX default bundled with 1YR UTM Pack in the on-premise mode For on-prem users, the new Gold Security Pack will start to consume when the current UTM Pack expires. Scenario 2 Activating the Gold Security Pack to a USG FLEX default bundled with 1YR UTM Pack in the…
-
Why the build-in AP model cannot modify its country code?
Background and Scenario: Why can a firewall with AP controller feature modify the country code (such as ATP800), but the built-in AP model (such as ATP100W) cannot modify the country code? As below: ATP800’s radio profile: there is a Country Code option. ATP100W’s radio profile: there is no Country Code option. Answer:…
-
Why the AP firmware version would be shown on the firewall?
Background and Scenario: Why when you check the log of the firewall and would see AP firmware related messages such as "AP firmware check successful. Available firmware: V6.50 Patch 1." Answer: Because Zyxel firewall supports AP controller feature, this message indicates that there is available firmware, V6.50 Patch 1,…
-
What is the difference between “Monitor interface” and “Enable Failover When Interface Failure”in HA
Question What is the difference between “Monitor interface” and “Enable Failover When Interface Failure” Answer Monitor Interface is for layer 1 physical link monitor, it is trigger by physical link up/down. Enable Failover When Interface Failure” works on layer 3, when you enable this, you also need to enable…
-
Why it does not work when we enable "Enable Highest Bandwidth Priority for SIP Traffic"
Question I had tick “Enable BWM” and “Enable Highest Bandwidth Priority for SIP Traffic” on “Configuration > BWM” Why it does not work when we enable "Enable Highest Bandwidth Priority for SIP Traffic" Answer It must enable SIP ALG on “Configuration > Network > ALG” when applying sip traffic QOS.
-
Why we are unable to access specific web site when hosts are behind FLEX/ATP?
Question Why some specific web sites are unable to access when hosts are behind FLEX/ATP, but those sites/URL can be access when bypass FLEX/ATP? Answer If web site has TTL expire issue, it leads to session drop by device. Please disable destroy session on this device and try it again. Router(config)# firewall icsa…
-
Why does my IPTV streaming sometimes have lag/latency when it is behind ATP?
Problem Description I would like place TV box behind ATP for Internet protection. However, the video streaming has latency when the TV box is behind ATP. As confirmed, gateway is not in high CPU usage, IGMP works, and Internet bandwidth is still available. Everything looks good without issue. Why does my IPTV streaming…
-
Why does SecuReporter not show any source MAC address in Traffic?
Check if device insight is enabled on the device. Once Device Insight is enabled, gateway starts to collect client device’s information, and query the fingerprint database to deeply identify. On the device, go to CONFIGURATION > Object > Device Insight to check if "Enable" is checked and a profile is configured.
-
If you think the content filter is not working as expected
Symptom: If you think the content filter has not worked the webpage as expected. Checking: 1) Please block QUIC Ports. QUIC uses UDP port 80 and port 443. The complete TLS client Hello, including any TLS Server Name Indication (SNI) present, is sent in one or more CRYPTO frames across one or more QUIC Initial packets. 2)…
-
When the site to site VPN traffic cannot reach Peer’s LAN
Symptom: 192.168.8.0/24 can’t access 192.168.9.0/24 Checking: 1)The policy of Any to ZyWALL have allowed ESP service and also allow AH if you it. Please ensure there are no deny rules above it. 2)VPN -> IPSec VPN -> VPN Connection , please check you have set zone. If you have customize zone, please remember to add…