connection vpn L2TP on local network work, but not by internet, dmz is OK on modem to USG

ptibonhomme

Hello,
i try little to little to configure my vpn installation.
today, my vpn work on local network, so i test ton enter in my vpn by other connection internet, but i have errors : 

I don't understand why there are errors between phase 1 and 2 when it works locally

Thanks for your help 

Zyxel_Stanley

Hi @ptibonhomme
You can make sure "My Address" setting of VPN phase 1 is configured as "0.0.0.0".

And also enter CLI command to unlock VPN incoming restriction. After applying configuration, reboot is required.
Router(config)# vpn-interface-restriction deactivate

ptibonhomme

Thanks for reply, i changer setting on the USG20, but the problem is same, the vpn is working for acces by lan but not by internet, always the same error on IKE log.
little question : in the method configuration client to site by L2TP on the zyxel site , no say to open restrisction on the cli of USG20.

ptibonhomme

for the " my adresse " of phase 1 ( 0.0.0.0 ) i must have the same adresse on phase 2 ? or i keep " interface ip" ?

PeterUK

Set both phase 1 local policy and phase 2 Domain Name / IPv4 to 0.0.0.0

Check your firewall rules have from WAN to Zywall and from zone  IPSec_VPN to Zywall with services ESP,IKE,L2TP-UDP and NATT 

ptibonhomme

hello , I tried with your settings  : still no connection
i show you my settings
Phase 1 :

phase 2


the rules


the log


i confirm , with this settings , the client VPN is connected if i am on a local network, the problem appears when i try to connect by internet .
thanks for you help, if you have an idea of the resolution

PeterUK

Is your WAN by Ethernet without PPP? As that might be the issue.

Are you able will changes to get the VPN to work over the internet at all?

Maybe the phase 1 and phase 2 have the encryption/authentication set to high?

ptibonhomme

Hello, i modified setting for connection :


and i think the encryption is not to high 

PeterUK

….or maybe the encryption/authentication is not high enough?

For phase 1 in order

3DES SHA 1

AES128 SHA1

key group DH2

For phase 2 in order

AES256 SHA1

AES128 SHA1

3DES SHA1

PFS none

ptibonhomme

i changed settings but not possible to connect , i show you the log

PeterUK

Does the USG have the WAN IP and not behind NAT?