-
Why can't I set up a Nebula Site-to-Site VPN between devices in different organizations?
If you are trying to set up a Nebula Site-to-Site VPN between two USG FLEX devices registered under different Nebula organizations, you will encounter issues because Nebula VPN only supports devices within the same organization.
-
Does USG LITE 60AX support certificate to connect VPN?
No, USG LITE 60AX only supports the account/password method to connect VPN.
-
How to avoid unexpected routing issues when enabling both IPsec VPN and L2TP VPN simultaneously?
Scenario : The user may need to enable both IPsec VPN and L2TP VPN remote settings simultaneously. How can unexpected routing issues be avoided when enabling both IPsec VPN and L2TP VPN at the same time? Answer : STEP1. Navigate to Site-wide > Configure > Firewall > Remote access VPN STEP2.Please ensure their Client VPN…
-
How to establish an VPN connection with a Nebula firewall by the macOS Sonoma native VPN client?
Question : After updating to macOS Sonoma, if you cannot establish an IKEv2 VPN connection with the Nebula firewall, how do you resolve this problem? Answer : Since there are changes to the VPN Phase 1 and Phase 2 parameters for macOS Sonoma's native VPN client, please modify them accordingly to allow the remote VPN to…
-
[ATP/FLEX] How to test a ping from one site to the remote VPN site on Nebula firewall?
Question: How to test a ping from one site to the remote VPN site on Nebula firewall? Answer: Firstly, ensure the VPN tunnel is established. Then access SSH or console of one Nebula firewall. [ATP/FLEX] How to access SSH service of Nebula Firewall? On SSH or console, enter the command to ping the client located in the…
-
Why is My VPN Not Connecting Even Though Settings are Identical?
Q: A specific user cannot connect to the VPN through their client, even though their settings are identical to others. What could be the issue? A: Sometimes, VPN connection issues can occur despite having identical settings, especially after Microsoft patches the system. In such cases, try the following steps: * Review the…
-
Is it possible to use SSL VPN on Nebula firewall?
Question: Is it possible to use SSL VPN on Nebula firewall? Answer: On Nebula, only IPSec VPN and L2TP VPN are available in Firewall > Remote access VPN. If you need to use SSL VPN on Nebula firewall, use Cloud Monitoring Mode instead. [ATP/FLEX] How to set up Nebula Monitor Mode? I want to use cloud monitoring mode, but…
-
Why is there Network Congestion on ATP700 VPN?
When experiencing network congestion on your ATP700 VPN, you might observe logs indicating full TX queues. This issue can stem from several factors: * Bandwidth Management (BWM) limiting traffic. * Interface ingress/egress bandwidth configuration. * Internet Service Provider (ISP) bandwidth restrictions. To address the…
-
How to Add a Second WAN Interface for VPN Failover on Nebula?
Question: How can I add a second WAN interface for VPN failover on my Nebula CC? Answer: To add a second WAN interface for VPN failover on your Nebula CC, follow these steps: * Navigate to Site-wide > Configure > Firewall > Site-to-Site VPN. * Change the outgoing interface to auto and set WAN 1 as the preferred link. * If…
-
Why Smart VPN does not work
Scenario: You have on cloud Firewall are trying to establish Non-Nebula VPN by Smart VPN function, but there are no negotiation packets, seems to the funciton does not enable. Answer: Please verify you have enabled "Nebula VPN enable" Feel free to reach out for further assistance if the issue persist.
-
How to troubleshoot the message "no proposal chosen" when it appeares in event logs?
Question: How to troubleshoot the message "no proposal chosen" when it appeares in event logs? Answer: Site-to-Site VPN (Both sites are Nebula firewalls) On nebula, there is no configuration for phase 1 and phase 2 proposal in Site-to-Site VPN. You can check phase 1 and phase 2 proposal using command via SSH. [ATP/FLEX]…
-
Where is the option of Dead Peer Detection on Nebula?
Question: Where is the option of Dead Peer Detection on Nebula? Answer: DPD is enabled by default in Nebula, so you cannot see the option in Nebula.
-
How to reset 2 factor authentication for Remote VPN user?
Scenario: I was trying to reset 2FA for a Remote VPN user, but the user has a new phone, and I need to update this 2FA, how can I do it? Answer: Go to Site-wide > Configure > Cloud authentication, edit the user, tick "Email to user" and click Update User, the user will receive a new email for 2fa authentication, then the…
-
How to fix non-Nebula VPN tunnel with Phase 2 policy mismatch
Scenarion: I was trying to configure non-Nebula VPN between two different Nebula orgs. The configuration was configured correctly, but the event logs show "Phase 2 policy mismatch". What happen? Answer: It could be remote subnet is mismatched. For Site_A, there are 3 local interfaces enabled for Site-to-Site VPN, and the…
-
[ATP/FLEX] How to Configure Multiple IP Segments Routing in Non-Nebula VPN scenario?
To connect remote LANs with non-Nebula IPSEC VPN, you need to set up a VTI interface in "Non-Nebula VPN" setting. 1. Navigate to the Non-Nebula VPN settings and click "IPSec Policy" Setting button. —> Under VPN tunnel interface, enter a custom IP address for the VPN tunnel. 2. Set up routing policies for your VPN traffic…
-
[ATP/FLEX]How do I renew IKEV2 certificate
Question: How do I renew IKEV2 certificate? Configuration steps: When the IKEv2 IPSec Client VPN certificate expires, follow these steps: Disable and enable IPSEC remote VPN on Nebula GUI. The firewall will re-generate a new certificate. Reinstall the new VPN script. Reboot the Firewall Note: Starting from 15th April 2024,…
-
[Nebula]Can I use a custom certificate for 2FA deployment on Nebula Remote Access IKEv2 VPN?
Question Can I use a custom certificate for 2FA deployment on Nebula Remote Access VPN? Answer The device's HTTPS uses a self-signed certificate and does not support importing third-party certificates. This limitation results in a certificate warning when accessing the 2FA screen, and using a custom certificate is not…
-
[ATP/FLEX] How do I view connected VPN users on Nebula?
Question: How do I view connected VPN users on Nebula? Answer: To view connected VPN users on Nebula, navigate to Monitor > Firewall > VPN Connections > Client to site VPN login account. This will display a list of currently connected VPN users. You can then view information such as the user's username, Assigned IP…
-
Why there is only one user can connect L2TP vpn tunnel?
Please make sure that your subnet settings have the correct subnet mask configuration. In most cases, users set it to /32, which means only one host can be connected.
-
Do I have to add extra security policies to ping IPSec VPN tunnel when IPSec VPN tunnel is connected
Question : Currently, Nebula supports site-to-site, hub-spoke, and remote VPN services. Is it necessary for the user to add extra security policies to enable pinging across the IPSec VPN tunnel when it's connected? Answer : No, once the user creates site-to-site, hub-spoke, and remote VPN settings on Nebula, corresponding…