IPSec VPNs not passing traffic after upgrading firmware to latest version.
We are running multiple IPSec VPN connections using USG110 (firmware version 4.73) and USG40W (firmware version 4.73) routers. We recently went through and performed firmware updates due to vulnerability concerns. After applying the updates we have noticed that VPN traffic is not passing properly. No configuration was changed for the VPNs and after going through logs, we are seeing that there are instances of the traffic being blocked by the default security policy rule. The proper rules are in place IPSec_VPN_Outgoing and IPSec_VPN_to_Device. Traffic appears to be bypassing the security policies and getting blocked by the default rule with the following message "Match default rule, DNAT Packet, DROP". Could the firmware be causing the issue? I've seen no problems with how the VPNs are configured and even went through Zyxel documentation to verify.
All Replies
-
Hi @SINC
Thanks for your inquiry. What is your current firmware version? Is it V4.73P2 firmware? Could you share a screenshot for the blocked message "Match default rule, DNAT Packet, DROP" with us?
Besides, please check whether the security policy "WAN_to_Device" allows IKE,NATT,AH,ESP VPN related traffics.
Thanks.
0
Categories
- All Categories
- 184 Beta Program
- 1.7K Nebula
- 89 Nebula Ideas
- 63 Nebula Status and Incidents
- 4.7K Security
- 236 Security Ideas
- 1.1K Switch
- 51 Switch Ideas
- 914 WirelessLAN
- 27 WLAN Ideas
- 5.4K Consumer Product
- 174 Service & License
- 295 News and Release
- 65 Security Advisories
- 14 Education Center
- 983 FAQ
- 426 Nebula FAQ
- 255 Security FAQ
- 100 Switch FAQ
- 115 WirelessLAN FAQ
- 21 Consumer Product FAQ
- 66 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 68 About Community
- 52 Security Highlight