IPSec VPNs not passing traffic after upgrading firmware to latest version.

SINC

We are running multiple IPSec VPN connections using USG110 (firmware version 4.73) and USG40W (firmware version 4.73) routers. We recently went through and performed firmware updates due to vulnerability concerns. After applying the updates we have noticed that VPN traffic is not passing properly. No configuration was changed for the VPNs and after going through logs, we are seeing that there are instances of the traffic being blocked by the default security policy rule. The proper rules are in place IPSec_VPN_Outgoing and IPSec_VPN_to_Device. Traffic appears to be bypassing the security policies and getting blocked by the default rule with the following message "Match default rule, DNAT Packet, DROP". Could the firmware be causing the issue? I've seen no problems with how the VPNs are configured and even went through Zyxel documentation to verify.

Zyxel_Jeff

Hi @SINC

Thanks for your inquiry. What is your current firmware version? Is it V4.73P2 firmware? Could you share a screenshot for the blocked message "Match default rule, DNAT Packet, DROP" with us?

Besides, please check whether the security policy "WAN_to_Device" allows IKE,NATT,AH,ESP VPN related traffics.

Thanks.