-
uOS IPv4 Pre-IPsec Fragmentation Configuration and Behavior Guide
1. Overview & Background In the uOS architecture, TCP traffic is actively protected by built-in MSS Clamping, which automatically adjusts the maximum segment size of TCP connections. Consequently, packet fragmentation caused by exceeding the MTU occurs significantly less often than in legacy ZLD firmware, and uOS does not…
-
💡Duo Security Authentication Integration Guide
This discussion has been moved.
-
[2026 January Spotlight] Integrate Secure Cloud Authentication with the USG FLEX H series
As organizations adopt cloud services and support remote and hybrid work models, identity has become a critical foundation of modern security. Traditional authentication methods based on locally managed accounts are increasingly difficult to scale and protect against today’s threats, including credential theft and…
-
Question with APP Patrol and SSL Inspection firmware V1.40(ABZI.0) USG Flex 700H
I would like to know where I might be going wrong, as App Patrol does not function correctly when I enable SSL Inspection—it simply fails to detect the traffic. For example, while the content filter successfully blocks YouTube when SSL Inspection is active, App Patrol fails to detect it; consequently, the "reject" action…
-
[USG Flex H] - How to manage sandbox and how to use the anti-malware functionality
Hello everyone, I've enabled the sandbox option and my question are: Under the action for malicious/suspicious files, I found only destroy or allow. How is possible to allow only some certain file/MD5Sum/HASH? It's possible to "browse" the blocked file and open it in a sandbox? For example, into a ZIP file I have an…
-
Network tool tracetcp now does not work
USG FLEX 700H V1.39(ABZI.0)ITS-260800953 or V1.39(ABZI.0)ITS-26WK32-m12287 seem there was a big changes in V1.39 such as slower throughput but now this tool does not work https://simulatedsimian.github.io/tracetcp.html In either a SNAT or bridge setup but in bridge if you turn off policy control then tracetcp works. My…
-
V1.40 Local Out Route?
Local Out Route option in routing So I'm not sure what this is meant to fix or how it works would someone from Zyxel like to explain a use case? thanks
-
Flex 100H: After firmware update to 1.40 port1 is often down for a few seconds
Hello, after firmware update to 1.40 port1 is often down for a few seconds. With firmware 1.39 the problem wasn't. What could I do to get a more stable connection on WAN Port1.
-
Connection issues with SSL VPN and IKEv2 on USG FLEX200H
Good evening. To enable remote access to our local network via an SSL VPN client, I configured SecuExtender (version 7.7.50.008) using a file downloaded from our USG FLEX 200H. While it connects successfully on PCs running Windows 10 and Windows Server 2019, it fails to connect on Windows 11. I also attempted to use IKEv2…
-
[USG Flex 500H] - New firmware 1.40 and port P2 DEAD
Hello everyone, yesterday I've upgraded my 500H to the newest 1.40 uOS version and seems, that for a strange question, that the port P2 is always down using the same cable. Disconnecting and reconnecting the same cable don't change the question, the port P2 is always disconnected and down. I've tried also to force manual…
-
I got following messages on my flex 50h with firmware 1.40
2026-10-22 11:34:35 User Response packet ID 8 does not match the request packet [count=2]
-
DDNS Type Cloudflare not working
USG FLEX 700H V1.39(ABZI.0)ITS-260701839 So here is the thing I make a subdomain test.bridgemode.co.uk with IP 127.0.0.1 knowing that this should be updated by this API token which I have setup and put into the FLEX H that shows Success and API token shows Last used by some seconds ago but the IP never updates.
-
AVAST API isn't working
Dear Sir or Madam. I've the api key from AVAST BUSINESS HUB. But it dosen't work.
-
50H 1.39 uOS - Really really slow VPN
Hello everyone, I config a VPN for a site where I have a 50H. I have 3x 50H in VPN configurator, everything work pretty fine among sites in VPN Orchestrator but I have a problem with remote VPN via PC. This is the speedtest from a server on that site: So outbound perf are fine. So I move a notebook from that site with 50H…
-
USG FLEX 200H (uOS 1.39): DDNS Effective IP is always the Backup address, even though the Primary in
Hi all, the DDNS address failover doesn't pick the primary IP address. Environment Device: USG FLEX 200H Firmware: V1.39 Problem The Effective IP in the DDNS status is always the Backup (Public IP) address. The Primary interface is up and reachable: link up, IP assigned, internet traffic goes through it, and the interface…
-
Solving this issue of certificates and VPN
So not sure if SecuExtender VPN Client solves but one way would be for the SecuExtender VPN Client to downland the certificate from the USG by user name and password on some port to update before connecting to the VPN. So what the issue? Certificates will last 47-days and if you have like strongswan or windows needing to…
-
H-Series Feature missing: Automatic PTR (reverse DNS) records for DNS A-Records on USG
Device / Firmware: USG FLEX 100H, firmware 1.40(ABXF.0). Probably affects all USG FLEX H series models running uOS. Description: On the legacy ZLD-based firewalls (USG / ZyWALL / USG FLEX non-H), the built-in DNS server had an “Address/PTR Record” table. Creating an entry such as vcenter01.example.local → 192.168.1.20…
-
FQDN Very Slow USG Flex 700h V1.40(ABZI.0)
Hello, Is there any way to force the FQDN for sites? This firmware version is significantly slower; the "test" button on the screen should ideally populate the IP tables immediately, after which it could continue operating as it currently does. Working with FQDNs is difficult due to this slowness—it can take days for the…
-
USG FLEX 200H blocks traffic from LAN1 to LAN2
Good evening. The USG FLEX 200H device is blocking traffic from LAN2 to LAN1, even though the policy is correctly configured. Conversely, traffic from LAN1 to LAN2 works fine. I have placed the rule in position 1 to avoid any potential conflicts, but it still does not work. The USG FLEX is running the latest firmware,…
-
Bumper start with V1.40 and DHCP server spamming
So not sure what want down with this version but at first was there was DHCP with SFP problems after the upgrade but interestingly was resolved after pulling the power for a cold start. As for the DHCP server spamming I have the FLEX 200H and 700H link by XGS1250-12 so FLEX 700H GE11 192.168.177.1/24 DHCP server to port 4…