IPSec VPNs not passing traffic after upgrading firmware to latest version.

SINC Posts: 5
First Comment Fifth Anniversary
 Freshman Member
edited June 9 in Security

We are running multiple IPSec VPN connections using USG110 (firmware version 4.73) and USG40W (firmware version 4.73) routers. We recently went through and performed firmware updates due to vulnerability concerns. After applying the updates we have noticed that VPN traffic is not passing properly. No configuration was changed for the VPNs and after going through logs, we are seeing that there are instances of the traffic being blocked by the default security policy rule. The proper rules are in place IPSec_VPN_Outgoing and IPSec_VPN_to_Device. Traffic appears to be bypassing the security policies and getting blocked by the default rule with the following message "Match default rule, DNAT Packet, DROP". Could the firmware be causing the issue? I've seen no problems with how the VPNs are configured and even went through Zyxel documentation to verify.

All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 850
    50 Answers 500 Comments Friend Collector Second Anniversary
     Zyxel Employee

    Hi @SINC

    Thanks for your inquiry. What is your current firmware version? Is it V4.73P2 firmware? Could you share a screenshot for the blocked message "Match default rule, DNAT Packet, DROP" with us?

    Besides, please check whether the security policy "WAN_to_Device" allows IKE,NATT,AH,ESP VPN related traffics.


Security Highlight